Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2023, 20:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a7aa2f97fcbce6772d9ce034db4219a5_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a7aa2f97fcbce6772d9ce034db4219a5_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
a7aa2f97fcbce6772d9ce034db4219a5_mafia_JC.exe
-
Size
486KB
-
MD5
a7aa2f97fcbce6772d9ce034db4219a5
-
SHA1
340aa567cfca66bc52093e17783585bb9bbb83a4
-
SHA256
42c8cefc9786949032684303e57e554c5188149e7333b43934c5fb4c975c2152
-
SHA512
6235519d94d6db9c4a41688495a7c4a6733813c21575ffd02347fae9b1820568984d982bf4672889a2542f06b444cacf24b2acd77158a4095de19ea937d7a853
-
SSDEEP
12288:UU5rCOTeiDBqqhyg9ytcdOsvuCMFKc6zhL6nQiNZ:UUQOJD70Qytcu3Kc6dLOQiN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1220 8F9D.tmp 2684 903A.tmp 2616 90C6.tmp 2828 91B1.tmp 3296 929B.tmp 1020 9347.tmp 3460 93F3.tmp 1704 94AE.tmp 1308 955A.tmp 3620 95F6.tmp 2228 9693.tmp 4124 971F.tmp 4920 979C.tmp 824 9858.tmp 4012 9942.tmp 1352 99DE.tmp 2404 9AB9.tmp 4324 9B46.tmp 4824 9C40.tmp 1684 9CEC.tmp 1496 9DD6.tmp 3320 9E63.tmp 3488 9F1E.tmp 404 A009.tmp 880 A0F3.tmp 516 A1CE.tmp 3300 A289.tmp 4876 A335.tmp 752 A400.tmp 4056 A4AC.tmp 948 A558.tmp 1384 A613.tmp 4940 A6DF.tmp 2512 A76B.tmp 2124 A7D9.tmp 4864 A884.tmp 3272 A8F2.tmp 2392 A98E.tmp 1472 AA0B.tmp 640 AA98.tmp 2216 AB15.tmp 940 ABB1.tmp 1556 AC4D.tmp 4748 ACBB.tmp 4616 AD57.tmp 3348 ADF3.tmp 1796 AE8F.tmp 3044 AEFD.tmp 3132 AF89.tmp 4360 B006.tmp 4892 B083.tmp 592 B12F.tmp 1652 B19D.tmp 1148 B229.tmp 3512 B2B6.tmp 5112 B362.tmp 1372 B3FE.tmp 800 B47B.tmp 1804 B508.tmp 5044 B5A4.tmp 3872 B640.tmp 2828 B6DC.tmp 2368 B769.tmp 2664 B7F6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3832 wrote to memory of 1220 3832 a7aa2f97fcbce6772d9ce034db4219a5_mafia_JC.exe 81 PID 3832 wrote to memory of 1220 3832 a7aa2f97fcbce6772d9ce034db4219a5_mafia_JC.exe 81 PID 3832 wrote to memory of 1220 3832 a7aa2f97fcbce6772d9ce034db4219a5_mafia_JC.exe 81 PID 1220 wrote to memory of 2684 1220 8F9D.tmp 82 PID 1220 wrote to memory of 2684 1220 8F9D.tmp 82 PID 1220 wrote to memory of 2684 1220 8F9D.tmp 82 PID 2684 wrote to memory of 2616 2684 903A.tmp 83 PID 2684 wrote to memory of 2616 2684 903A.tmp 83 PID 2684 wrote to memory of 2616 2684 903A.tmp 83 PID 2616 wrote to memory of 2828 2616 90C6.tmp 84 PID 2616 wrote to memory of 2828 2616 90C6.tmp 84 PID 2616 wrote to memory of 2828 2616 90C6.tmp 84 PID 2828 wrote to memory of 3296 2828 91B1.tmp 85 PID 2828 wrote to memory of 3296 2828 91B1.tmp 85 PID 2828 wrote to memory of 3296 2828 91B1.tmp 85 PID 3296 wrote to memory of 1020 3296 929B.tmp 86 PID 3296 wrote to memory of 1020 3296 929B.tmp 86 PID 3296 wrote to memory of 1020 3296 929B.tmp 86 PID 1020 wrote to memory of 3460 1020 9347.tmp 87 PID 1020 wrote to memory of 3460 1020 9347.tmp 87 PID 1020 wrote to memory of 3460 1020 9347.tmp 87 PID 3460 wrote to memory of 1704 3460 93F3.tmp 88 PID 3460 wrote to memory of 1704 3460 93F3.tmp 88 PID 3460 wrote to memory of 1704 3460 93F3.tmp 88 PID 1704 wrote to memory of 1308 1704 94AE.tmp 89 PID 1704 wrote to memory of 1308 1704 94AE.tmp 89 PID 1704 wrote to memory of 1308 1704 94AE.tmp 89 PID 1308 wrote to memory of 3620 1308 955A.tmp 90 PID 1308 wrote to memory of 3620 1308 955A.tmp 90 PID 1308 wrote to memory of 3620 1308 955A.tmp 90 PID 3620 wrote to memory of 2228 3620 95F6.tmp 91 PID 3620 wrote to memory of 2228 3620 95F6.tmp 91 PID 3620 wrote to memory of 2228 3620 95F6.tmp 91 PID 2228 wrote to memory of 4124 2228 9693.tmp 93 PID 2228 wrote to memory of 4124 2228 9693.tmp 93 PID 2228 wrote to memory of 4124 2228 9693.tmp 93 PID 4124 wrote to memory of 4920 4124 971F.tmp 94 PID 4124 wrote to memory of 4920 4124 971F.tmp 94 PID 4124 wrote to memory of 4920 4124 971F.tmp 94 PID 4920 wrote to memory of 824 4920 979C.tmp 95 PID 4920 wrote to memory of 824 4920 979C.tmp 95 PID 4920 wrote to memory of 824 4920 979C.tmp 95 PID 824 wrote to memory of 4012 824 9858.tmp 96 PID 824 wrote to memory of 4012 824 9858.tmp 96 PID 824 wrote to memory of 4012 824 9858.tmp 96 PID 4012 wrote to memory of 1352 4012 9942.tmp 97 PID 4012 wrote to memory of 1352 4012 9942.tmp 97 PID 4012 wrote to memory of 1352 4012 9942.tmp 97 PID 1352 wrote to memory of 2404 1352 99DE.tmp 98 PID 1352 wrote to memory of 2404 1352 99DE.tmp 98 PID 1352 wrote to memory of 2404 1352 99DE.tmp 98 PID 2404 wrote to memory of 4324 2404 9AB9.tmp 99 PID 2404 wrote to memory of 4324 2404 9AB9.tmp 99 PID 2404 wrote to memory of 4324 2404 9AB9.tmp 99 PID 4324 wrote to memory of 4824 4324 9B46.tmp 100 PID 4324 wrote to memory of 4824 4324 9B46.tmp 100 PID 4324 wrote to memory of 4824 4324 9B46.tmp 100 PID 4824 wrote to memory of 1684 4824 9C40.tmp 101 PID 4824 wrote to memory of 1684 4824 9C40.tmp 101 PID 4824 wrote to memory of 1684 4824 9C40.tmp 101 PID 1684 wrote to memory of 1496 1684 9CEC.tmp 102 PID 1684 wrote to memory of 1496 1684 9CEC.tmp 102 PID 1684 wrote to memory of 1496 1684 9CEC.tmp 102 PID 1496 wrote to memory of 3320 1496 9DD6.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7aa2f97fcbce6772d9ce034db4219a5_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\a7aa2f97fcbce6772d9ce034db4219a5_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"23⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"24⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"25⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"26⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"27⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"28⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"29⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"30⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"31⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"32⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"33⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"34⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"35⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"36⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"37⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"38⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"39⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"40⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"41⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"42⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"43⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"44⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"45⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"46⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"47⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"48⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"49⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"50⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"51⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"52⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"53⤵
- Executes dropped EXE
PID:592 -
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"54⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"55⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"56⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"57⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"58⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"59⤵
- Executes dropped EXE
PID:800 -
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"60⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"61⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"62⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"63⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"64⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"65⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"66⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"67⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"68⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"69⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"70⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"71⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"72⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"73⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"74⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"75⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"76⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"77⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"78⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"79⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"80⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"81⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"82⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"83⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"84⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"85⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"86⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"87⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"88⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"89⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"90⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"91⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"92⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"93⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"94⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"95⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"96⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"97⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"98⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"99⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"100⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"101⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\C96A.tmp"C:\Users\Admin\AppData\Local\Temp\C96A.tmp"102⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"103⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"104⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"105⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"106⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"107⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"108⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"109⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"110⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"111⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"112⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"113⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"114⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"115⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"116⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"117⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"118⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"119⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"120⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"121⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"122⤵PID:4384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-