Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
15/08/2023, 19:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02be5e9b9016c6954186d6c1c9b14e9e_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
02be5e9b9016c6954186d6c1c9b14e9e_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
02be5e9b9016c6954186d6c1c9b14e9e_mafia_JC.exe
-
Size
486KB
-
MD5
02be5e9b9016c6954186d6c1c9b14e9e
-
SHA1
e6832cb20ba6a3dddda930f72ee2c9215c63eb2b
-
SHA256
51025b730f744b0774c818cf3ef600600ce4502d91e75f2fb3f1333e4b050a97
-
SHA512
601fdde75622cb1f90f4be84c56ab0a4ff123a3f9ce8a9e6a61061d78599c6a397b85f55ffe1882ce9b6c01610220e1e29dad8a578bdd5e3c9618325100fe571
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7sUwitwblfmkoc6IlukyZlNER2NTKgHfxyFAt:/U5rCOTeiDvw6wfxnzluHvtF5BLWkNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4036 F2E.tmp 1176 14AC.tmp 4832 15F4.tmp 3740 16BF.tmp 2112 179A.tmp 3324 1846.tmp 1372 1901.tmp 5060 19BD.tmp 1160 1A69.tmp 824 1B05.tmp 1928 1C6C.tmp 4168 1D37.tmp 4856 1DD4.tmp 740 1F6A.tmp 2472 2045.tmp 2068 2100.tmp 4452 21DB.tmp 1424 22E5.tmp 4292 23A0.tmp 3536 244C.tmp 3108 24E8.tmp 1864 25B3.tmp 3716 26CD.tmp 1152 274A.tmp 1128 27D6.tmp 2284 2882.tmp 3052 295D.tmp 748 2A18.tmp 4976 2AA5.tmp 3724 2B41.tmp 4184 2C0C.tmp 4252 2CC8.tmp 3756 2D83.tmp 1184 2E20.tmp 4584 2ECB.tmp 784 2F68.tmp 1560 3004.tmp 5084 3071.tmp 1564 310E.tmp 4260 317B.tmp 1968 3275.tmp 3904 3330.tmp 4440 33DC.tmp 3024 3469.tmp 4204 3524.tmp 3688 35D0.tmp 4508 363E.tmp 2872 36BB.tmp 4456 3728.tmp 3336 37E4.tmp 656 3880.tmp 2524 38FD.tmp 2288 39C8.tmp 4228 3A55.tmp 4284 3AD2.tmp 5108 3B4F.tmp 2240 3BEB.tmp 2116 3C58.tmp 1176 3CF4.tmp 4464 3D81.tmp 1976 3E0E.tmp 5028 3EC9.tmp 2876 3F37.tmp 3216 3FA4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3480 wrote to memory of 4036 3480 02be5e9b9016c6954186d6c1c9b14e9e_mafia_JC.exe 81 PID 3480 wrote to memory of 4036 3480 02be5e9b9016c6954186d6c1c9b14e9e_mafia_JC.exe 81 PID 3480 wrote to memory of 4036 3480 02be5e9b9016c6954186d6c1c9b14e9e_mafia_JC.exe 81 PID 4036 wrote to memory of 1176 4036 F2E.tmp 82 PID 4036 wrote to memory of 1176 4036 F2E.tmp 82 PID 4036 wrote to memory of 1176 4036 F2E.tmp 82 PID 1176 wrote to memory of 4832 1176 14AC.tmp 83 PID 1176 wrote to memory of 4832 1176 14AC.tmp 83 PID 1176 wrote to memory of 4832 1176 14AC.tmp 83 PID 4832 wrote to memory of 3740 4832 15F4.tmp 84 PID 4832 wrote to memory of 3740 4832 15F4.tmp 84 PID 4832 wrote to memory of 3740 4832 15F4.tmp 84 PID 3740 wrote to memory of 2112 3740 16BF.tmp 85 PID 3740 wrote to memory of 2112 3740 16BF.tmp 85 PID 3740 wrote to memory of 2112 3740 16BF.tmp 85 PID 2112 wrote to memory of 3324 2112 179A.tmp 86 PID 2112 wrote to memory of 3324 2112 179A.tmp 86 PID 2112 wrote to memory of 3324 2112 179A.tmp 86 PID 3324 wrote to memory of 1372 3324 1846.tmp 87 PID 3324 wrote to memory of 1372 3324 1846.tmp 87 PID 3324 wrote to memory of 1372 3324 1846.tmp 87 PID 1372 wrote to memory of 5060 1372 1901.tmp 88 PID 1372 wrote to memory of 5060 1372 1901.tmp 88 PID 1372 wrote to memory of 5060 1372 1901.tmp 88 PID 5060 wrote to memory of 1160 5060 19BD.tmp 89 PID 5060 wrote to memory of 1160 5060 19BD.tmp 89 PID 5060 wrote to memory of 1160 5060 19BD.tmp 89 PID 1160 wrote to memory of 824 1160 1A69.tmp 90 PID 1160 wrote to memory of 824 1160 1A69.tmp 90 PID 1160 wrote to memory of 824 1160 1A69.tmp 90 PID 824 wrote to memory of 1928 824 1B05.tmp 91 PID 824 wrote to memory of 1928 824 1B05.tmp 91 PID 824 wrote to memory of 1928 824 1B05.tmp 91 PID 1928 wrote to memory of 4168 1928 1C6C.tmp 92 PID 1928 wrote to memory of 4168 1928 1C6C.tmp 92 PID 1928 wrote to memory of 4168 1928 1C6C.tmp 92 PID 4168 wrote to memory of 4856 4168 1D37.tmp 93 PID 4168 wrote to memory of 4856 4168 1D37.tmp 93 PID 4168 wrote to memory of 4856 4168 1D37.tmp 93 PID 4856 wrote to memory of 740 4856 1DD4.tmp 94 PID 4856 wrote to memory of 740 4856 1DD4.tmp 94 PID 4856 wrote to memory of 740 4856 1DD4.tmp 94 PID 740 wrote to memory of 2472 740 1F6A.tmp 95 PID 740 wrote to memory of 2472 740 1F6A.tmp 95 PID 740 wrote to memory of 2472 740 1F6A.tmp 95 PID 2472 wrote to memory of 2068 2472 2045.tmp 96 PID 2472 wrote to memory of 2068 2472 2045.tmp 96 PID 2472 wrote to memory of 2068 2472 2045.tmp 96 PID 2068 wrote to memory of 4452 2068 2100.tmp 97 PID 2068 wrote to memory of 4452 2068 2100.tmp 97 PID 2068 wrote to memory of 4452 2068 2100.tmp 97 PID 4452 wrote to memory of 1424 4452 21DB.tmp 99 PID 4452 wrote to memory of 1424 4452 21DB.tmp 99 PID 4452 wrote to memory of 1424 4452 21DB.tmp 99 PID 1424 wrote to memory of 4292 1424 22E5.tmp 100 PID 1424 wrote to memory of 4292 1424 22E5.tmp 100 PID 1424 wrote to memory of 4292 1424 22E5.tmp 100 PID 4292 wrote to memory of 3536 4292 23A0.tmp 101 PID 4292 wrote to memory of 3536 4292 23A0.tmp 101 PID 4292 wrote to memory of 3536 4292 23A0.tmp 101 PID 3536 wrote to memory of 3108 3536 244C.tmp 102 PID 3536 wrote to memory of 3108 3536 244C.tmp 102 PID 3536 wrote to memory of 3108 3536 244C.tmp 102 PID 3108 wrote to memory of 1864 3108 24E8.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\02be5e9b9016c6954186d6c1c9b14e9e_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\02be5e9b9016c6954186d6c1c9b14e9e_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\F2E.tmp"C:\Users\Admin\AppData\Local\Temp\F2E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\14AC.tmp"C:\Users\Admin\AppData\Local\Temp\14AC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\16BF.tmp"C:\Users\Admin\AppData\Local\Temp\16BF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\179A.tmp"C:\Users\Admin\AppData\Local\Temp\179A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\1846.tmp"C:\Users\Admin\AppData\Local\Temp\1846.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\19BD.tmp"C:\Users\Admin\AppData\Local\Temp\19BD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\1B05.tmp"C:\Users\Admin\AppData\Local\Temp\1B05.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\1D37.tmp"C:\Users\Admin\AppData\Local\Temp\1D37.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\21DB.tmp"C:\Users\Admin\AppData\Local\Temp\21DB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\23A0.tmp"C:\Users\Admin\AppData\Local\Temp\23A0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\244C.tmp"C:\Users\Admin\AppData\Local\Temp\244C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\25B3.tmp"C:\Users\Admin\AppData\Local\Temp\25B3.tmp"23⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\26CD.tmp"C:\Users\Admin\AppData\Local\Temp\26CD.tmp"24⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"25⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\27D6.tmp"C:\Users\Admin\AppData\Local\Temp\27D6.tmp"26⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\2882.tmp"C:\Users\Admin\AppData\Local\Temp\2882.tmp"27⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"28⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"29⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"30⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\2B41.tmp"C:\Users\Admin\AppData\Local\Temp\2B41.tmp"31⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"32⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"33⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\2D83.tmp"C:\Users\Admin\AppData\Local\Temp\2D83.tmp"34⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\2E20.tmp"C:\Users\Admin\AppData\Local\Temp\2E20.tmp"35⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"36⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\2F68.tmp"C:\Users\Admin\AppData\Local\Temp\2F68.tmp"37⤵
- Executes dropped EXE
PID:784 -
C:\Users\Admin\AppData\Local\Temp\3004.tmp"C:\Users\Admin\AppData\Local\Temp\3004.tmp"38⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\3071.tmp"C:\Users\Admin\AppData\Local\Temp\3071.tmp"39⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\310E.tmp"C:\Users\Admin\AppData\Local\Temp\310E.tmp"40⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\317B.tmp"C:\Users\Admin\AppData\Local\Temp\317B.tmp"41⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\3275.tmp"C:\Users\Admin\AppData\Local\Temp\3275.tmp"42⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3330.tmp"C:\Users\Admin\AppData\Local\Temp\3330.tmp"43⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"44⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"45⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"46⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"47⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\363E.tmp"C:\Users\Admin\AppData\Local\Temp\363E.tmp"48⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\36BB.tmp"C:\Users\Admin\AppData\Local\Temp\36BB.tmp"49⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\3728.tmp"C:\Users\Admin\AppData\Local\Temp\3728.tmp"50⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"51⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\3880.tmp"C:\Users\Admin\AppData\Local\Temp\3880.tmp"52⤵
- Executes dropped EXE
PID:656 -
C:\Users\Admin\AppData\Local\Temp\38FD.tmp"C:\Users\Admin\AppData\Local\Temp\38FD.tmp"53⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\39C8.tmp"C:\Users\Admin\AppData\Local\Temp\39C8.tmp"54⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"55⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"56⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"57⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"58⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\3C58.tmp"C:\Users\Admin\AppData\Local\Temp\3C58.tmp"59⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"60⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\3D81.tmp"C:\Users\Admin\AppData\Local\Temp\3D81.tmp"61⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"62⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"63⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\3F37.tmp"C:\Users\Admin\AppData\Local\Temp\3F37.tmp"64⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"65⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\4021.tmp"C:\Users\Admin\AppData\Local\Temp\4021.tmp"66⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\40AE.tmp"C:\Users\Admin\AppData\Local\Temp\40AE.tmp"67⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\412B.tmp"C:\Users\Admin\AppData\Local\Temp\412B.tmp"68⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\41B7.tmp"C:\Users\Admin\AppData\Local\Temp\41B7.tmp"69⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\4244.tmp"C:\Users\Admin\AppData\Local\Temp\4244.tmp"70⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\42E0.tmp"C:\Users\Admin\AppData\Local\Temp\42E0.tmp"71⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\435D.tmp"C:\Users\Admin\AppData\Local\Temp\435D.tmp"72⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\43DA.tmp"C:\Users\Admin\AppData\Local\Temp\43DA.tmp"73⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\4486.tmp"C:\Users\Admin\AppData\Local\Temp\4486.tmp"74⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\44E4.tmp"C:\Users\Admin\AppData\Local\Temp\44E4.tmp"75⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"76⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\45CE.tmp"C:\Users\Admin\AppData\Local\Temp\45CE.tmp"77⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\466A.tmp"C:\Users\Admin\AppData\Local\Temp\466A.tmp"78⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\46E7.tmp"C:\Users\Admin\AppData\Local\Temp\46E7.tmp"79⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"80⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\4801.tmp"C:\Users\Admin\AppData\Local\Temp\4801.tmp"81⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\487E.tmp"C:\Users\Admin\AppData\Local\Temp\487E.tmp"82⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\48EB.tmp"C:\Users\Admin\AppData\Local\Temp\48EB.tmp"83⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\4978.tmp"C:\Users\Admin\AppData\Local\Temp\4978.tmp"84⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\4A04.tmp"C:\Users\Admin\AppData\Local\Temp\4A04.tmp"85⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"86⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"87⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"88⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"89⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\4C75.tmp"C:\Users\Admin\AppData\Local\Temp\4C75.tmp"90⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"91⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"92⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"93⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\4E79.tmp"C:\Users\Admin\AppData\Local\Temp\4E79.tmp"94⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\4F05.tmp"C:\Users\Admin\AppData\Local\Temp\4F05.tmp"95⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\4F73.tmp"C:\Users\Admin\AppData\Local\Temp\4F73.tmp"96⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"97⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\509C.tmp"C:\Users\Admin\AppData\Local\Temp\509C.tmp"98⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\5138.tmp"C:\Users\Admin\AppData\Local\Temp\5138.tmp"99⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\51A5.tmp"C:\Users\Admin\AppData\Local\Temp\51A5.tmp"100⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\5251.tmp"C:\Users\Admin\AppData\Local\Temp\5251.tmp"101⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\52BF.tmp"C:\Users\Admin\AppData\Local\Temp\52BF.tmp"102⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\533C.tmp"C:\Users\Admin\AppData\Local\Temp\533C.tmp"103⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\53B9.tmp"C:\Users\Admin\AppData\Local\Temp\53B9.tmp"104⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\5445.tmp"C:\Users\Admin\AppData\Local\Temp\5445.tmp"105⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\54C2.tmp"C:\Users\Admin\AppData\Local\Temp\54C2.tmp"106⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\554F.tmp"C:\Users\Admin\AppData\Local\Temp\554F.tmp"107⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\55CC.tmp"C:\Users\Admin\AppData\Local\Temp\55CC.tmp"108⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\5649.tmp"C:\Users\Admin\AppData\Local\Temp\5649.tmp"109⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\5704.tmp"C:\Users\Admin\AppData\Local\Temp\5704.tmp"110⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\5781.tmp"C:\Users\Admin\AppData\Local\Temp\5781.tmp"111⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\57FE.tmp"C:\Users\Admin\AppData\Local\Temp\57FE.tmp"112⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\588B.tmp"C:\Users\Admin\AppData\Local\Temp\588B.tmp"113⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"114⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"115⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"116⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"117⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"118⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"119⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\5C44.tmp"C:\Users\Admin\AppData\Local\Temp\5C44.tmp"120⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"121⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"122⤵PID:2964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-