Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2023, 13:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
41f08ddceaac93a3c927866de193ccd5_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
41f08ddceaac93a3c927866de193ccd5_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
41f08ddceaac93a3c927866de193ccd5_mafia_JC.exe
-
Size
520KB
-
MD5
41f08ddceaac93a3c927866de193ccd5
-
SHA1
ac69e31a8c38725212199d1218f3a1714265b1ed
-
SHA256
3cf69a20e0f0bdd56fe546aa2d6fbb7a307c221c8df9af3b727e799bfeeec062
-
SHA512
0e60fbe386520480c0b52fd9a49e7a362dbe7664dc09997630bf19b12486d471918f6340ee9b71020920182f61ff00294e72045c00591ef6112b680266ff184f
-
SSDEEP
12288:roRXOQjmOyAXqsGfRPTgq38DFw5CFGvYXwNZ:rogQ9y8wRJkFn/wN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4252 71A6.tmp 1384 7280.tmp 4020 737A.tmp 1020 7436.tmp 1292 74E2.tmp 4860 760B.tmp 2504 76C6.tmp 5060 77C0.tmp 1896 787C.tmp 2692 7976.tmp 232 7A7F.tmp 2936 7B5A.tmp 1136 7C73.tmp 4512 7D4E.tmp 4708 7E29.tmp 456 7EF4.tmp 1684 7FBF.tmp 4144 80A9.tmp 3636 8194.tmp 3352 827E.tmp 2988 831A.tmp 2540 8414.tmp 3032 84FF.tmp 2324 8618.tmp 3360 8702.tmp 1932 879F.tmp 4620 8879.tmp 3384 8916.tmp 2412 89F0.tmp 3632 8AAC.tmp 540 8B96.tmp 2684 8C52.tmp 2816 8D4C.tmp 2600 8DC9.tmp 1080 8E46.tmp 2108 8EC3.tmp 3996 8F40.tmp 2160 8FCC.tmp 2476 9059.tmp 4436 90E6.tmp 3324 9182.tmp 1784 920E.tmp 4596 92BA.tmp 1780 9337.tmp 4604 93C4.tmp 3748 9460.tmp 3312 94ED.tmp 4460 9589.tmp 1016 9625.tmp 2500 96A2.tmp 3732 972F.tmp 1580 979C.tmp 2272 97FA.tmp 3624 9867.tmp 3984 98D5.tmp 4580 9933.tmp 4544 99A0.tmp 1380 9A1D.tmp 3192 9AB9.tmp 2584 9B46.tmp 1440 9BC3.tmp 3508 9C5F.tmp 3628 9CFB.tmp 3872 9D88.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 996 wrote to memory of 4252 996 41f08ddceaac93a3c927866de193ccd5_mafia_JC.exe 80 PID 996 wrote to memory of 4252 996 41f08ddceaac93a3c927866de193ccd5_mafia_JC.exe 80 PID 996 wrote to memory of 4252 996 41f08ddceaac93a3c927866de193ccd5_mafia_JC.exe 80 PID 4252 wrote to memory of 1384 4252 71A6.tmp 81 PID 4252 wrote to memory of 1384 4252 71A6.tmp 81 PID 4252 wrote to memory of 1384 4252 71A6.tmp 81 PID 1384 wrote to memory of 4020 1384 7280.tmp 82 PID 1384 wrote to memory of 4020 1384 7280.tmp 82 PID 1384 wrote to memory of 4020 1384 7280.tmp 82 PID 4020 wrote to memory of 1020 4020 737A.tmp 83 PID 4020 wrote to memory of 1020 4020 737A.tmp 83 PID 4020 wrote to memory of 1020 4020 737A.tmp 83 PID 1020 wrote to memory of 1292 1020 7436.tmp 84 PID 1020 wrote to memory of 1292 1020 7436.tmp 84 PID 1020 wrote to memory of 1292 1020 7436.tmp 84 PID 1292 wrote to memory of 4860 1292 74E2.tmp 85 PID 1292 wrote to memory of 4860 1292 74E2.tmp 85 PID 1292 wrote to memory of 4860 1292 74E2.tmp 85 PID 4860 wrote to memory of 2504 4860 760B.tmp 86 PID 4860 wrote to memory of 2504 4860 760B.tmp 86 PID 4860 wrote to memory of 2504 4860 760B.tmp 86 PID 2504 wrote to memory of 5060 2504 76C6.tmp 87 PID 2504 wrote to memory of 5060 2504 76C6.tmp 87 PID 2504 wrote to memory of 5060 2504 76C6.tmp 87 PID 5060 wrote to memory of 1896 5060 77C0.tmp 88 PID 5060 wrote to memory of 1896 5060 77C0.tmp 88 PID 5060 wrote to memory of 1896 5060 77C0.tmp 88 PID 1896 wrote to memory of 2692 1896 787C.tmp 89 PID 1896 wrote to memory of 2692 1896 787C.tmp 89 PID 1896 wrote to memory of 2692 1896 787C.tmp 89 PID 2692 wrote to memory of 232 2692 7976.tmp 90 PID 2692 wrote to memory of 232 2692 7976.tmp 90 PID 2692 wrote to memory of 232 2692 7976.tmp 90 PID 232 wrote to memory of 2936 232 7A7F.tmp 91 PID 232 wrote to memory of 2936 232 7A7F.tmp 91 PID 232 wrote to memory of 2936 232 7A7F.tmp 91 PID 2936 wrote to memory of 1136 2936 7B5A.tmp 92 PID 2936 wrote to memory of 1136 2936 7B5A.tmp 92 PID 2936 wrote to memory of 1136 2936 7B5A.tmp 92 PID 1136 wrote to memory of 4512 1136 7C73.tmp 93 PID 1136 wrote to memory of 4512 1136 7C73.tmp 93 PID 1136 wrote to memory of 4512 1136 7C73.tmp 93 PID 4512 wrote to memory of 4708 4512 7D4E.tmp 94 PID 4512 wrote to memory of 4708 4512 7D4E.tmp 94 PID 4512 wrote to memory of 4708 4512 7D4E.tmp 94 PID 4708 wrote to memory of 456 4708 7E29.tmp 95 PID 4708 wrote to memory of 456 4708 7E29.tmp 95 PID 4708 wrote to memory of 456 4708 7E29.tmp 95 PID 456 wrote to memory of 1684 456 7EF4.tmp 96 PID 456 wrote to memory of 1684 456 7EF4.tmp 96 PID 456 wrote to memory of 1684 456 7EF4.tmp 96 PID 1684 wrote to memory of 4144 1684 7FBF.tmp 97 PID 1684 wrote to memory of 4144 1684 7FBF.tmp 97 PID 1684 wrote to memory of 4144 1684 7FBF.tmp 97 PID 4144 wrote to memory of 3636 4144 80A9.tmp 98 PID 4144 wrote to memory of 3636 4144 80A9.tmp 98 PID 4144 wrote to memory of 3636 4144 80A9.tmp 98 PID 3636 wrote to memory of 3352 3636 8194.tmp 99 PID 3636 wrote to memory of 3352 3636 8194.tmp 99 PID 3636 wrote to memory of 3352 3636 8194.tmp 99 PID 3352 wrote to memory of 2988 3352 827E.tmp 100 PID 3352 wrote to memory of 2988 3352 827E.tmp 100 PID 3352 wrote to memory of 2988 3352 827E.tmp 100 PID 2988 wrote to memory of 2540 2988 831A.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\41f08ddceaac93a3c927866de193ccd5_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\41f08ddceaac93a3c927866de193ccd5_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"23⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"24⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"25⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"26⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"27⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"28⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"29⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"30⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"31⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"32⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"33⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"34⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"35⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"36⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"37⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"38⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"39⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"40⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"41⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"42⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"43⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"44⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"45⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"46⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"47⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"48⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"49⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"50⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"51⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"52⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"53⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"54⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"55⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"56⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"57⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"58⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"59⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"60⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"61⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"62⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"63⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"64⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"65⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"66⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"67⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"68⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"69⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"70⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"71⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"72⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"73⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"74⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"75⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"76⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"77⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"78⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"79⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"80⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"81⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"82⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"83⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"84⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"85⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"86⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"87⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"88⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"89⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"90⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"91⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"92⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"93⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"94⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"95⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"96⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"97⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"98⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"99⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"100⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"101⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"102⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"103⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"104⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"105⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"106⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"107⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"108⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"109⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"110⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"111⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"112⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"113⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"114⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"115⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"116⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"117⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"118⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"119⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"120⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"121⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"122⤵PID:5108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-