Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2023, 14:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
131ed64a777ca27fe6e8488a2bb9dbda_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
131ed64a777ca27fe6e8488a2bb9dbda_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
131ed64a777ca27fe6e8488a2bb9dbda_mafia_JC.exe
-
Size
488KB
-
MD5
131ed64a777ca27fe6e8488a2bb9dbda
-
SHA1
c76d68a27e5f9826a76a3d10b8fc708b2649fe53
-
SHA256
2e239e74fdae895828648e4a307ff096b5a3fb58e899a7807cfb2d7122abdd99
-
SHA512
665684dbeb1340c272b07df2e3762a92f19bfc384323613c9050f24e3480cac485c49824e197d5d627ef6258462897305070811feb285a1c8846758e767719ef
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD78SF/pRWJ35RzeS/jwpwB4C3U+08Pu4tb2Ce/:/U5rCOTeiDHrRWJpRzeSpTkHoJeU8NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2924 80B9.tmp 680 8146.tmp 3864 8201.tmp 1684 830B.tmp 1704 83C6.tmp 2888 8482.tmp 4432 856C.tmp 428 8628.tmp 4692 8712.tmp 3408 87AE.tmp 2172 88A8.tmp 3080 8954.tmp 1508 8A3E.tmp 4860 8B48.tmp 3648 8C23.tmp 232 8CAF.tmp 3724 8D7B.tmp 4612 8E65.tmp 4940 8F30.tmp 2736 902A.tmp 3308 90D6.tmp 4728 91C0.tmp 3852 929B.tmp 4296 9337.tmp 856 93E3.tmp 2704 947F.tmp 4800 953B.tmp 3696 9606.tmp 1496 96C2.tmp 4804 979C.tmp 60 9829.tmp 2820 98E4.tmp 2132 9981.tmp 1540 9A1D.tmp 1536 9AB9.tmp 1688 9B55.tmp 644 9BD2.tmp 2812 9C5F.tmp 780 9CCC.tmp 4976 9D69.tmp 4684 9DF5.tmp 1672 9E82.tmp 1592 9F2E.tmp 4176 9FCA.tmp 1012 A086.tmp 4272 A112.tmp 4784 A1AE.tmp 4876 A23B.tmp 3456 A2C8.tmp 4436 A354.tmp 1912 A3D1.tmp 972 A44E.tmp 3460 A4DB.tmp 5052 A558.tmp 2296 A5D5.tmp 4880 A652.tmp 3248 A6DF.tmp 1392 A77B.tmp 4432 A827.tmp 5072 A8B3.tmp 4924 A930.tmp 4748 A9AD.tmp 3408 AA1B.tmp 2172 AA78.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2940 wrote to memory of 2924 2940 131ed64a777ca27fe6e8488a2bb9dbda_mafia_JC.exe 81 PID 2940 wrote to memory of 2924 2940 131ed64a777ca27fe6e8488a2bb9dbda_mafia_JC.exe 81 PID 2940 wrote to memory of 2924 2940 131ed64a777ca27fe6e8488a2bb9dbda_mafia_JC.exe 81 PID 2924 wrote to memory of 680 2924 80B9.tmp 82 PID 2924 wrote to memory of 680 2924 80B9.tmp 82 PID 2924 wrote to memory of 680 2924 80B9.tmp 82 PID 680 wrote to memory of 3864 680 8146.tmp 83 PID 680 wrote to memory of 3864 680 8146.tmp 83 PID 680 wrote to memory of 3864 680 8146.tmp 83 PID 3864 wrote to memory of 1684 3864 8201.tmp 84 PID 3864 wrote to memory of 1684 3864 8201.tmp 84 PID 3864 wrote to memory of 1684 3864 8201.tmp 84 PID 1684 wrote to memory of 1704 1684 830B.tmp 85 PID 1684 wrote to memory of 1704 1684 830B.tmp 85 PID 1684 wrote to memory of 1704 1684 830B.tmp 85 PID 1704 wrote to memory of 2888 1704 83C6.tmp 86 PID 1704 wrote to memory of 2888 1704 83C6.tmp 86 PID 1704 wrote to memory of 2888 1704 83C6.tmp 86 PID 2888 wrote to memory of 4432 2888 8482.tmp 87 PID 2888 wrote to memory of 4432 2888 8482.tmp 87 PID 2888 wrote to memory of 4432 2888 8482.tmp 87 PID 4432 wrote to memory of 428 4432 856C.tmp 88 PID 4432 wrote to memory of 428 4432 856C.tmp 88 PID 4432 wrote to memory of 428 4432 856C.tmp 88 PID 428 wrote to memory of 4692 428 8628.tmp 89 PID 428 wrote to memory of 4692 428 8628.tmp 89 PID 428 wrote to memory of 4692 428 8628.tmp 89 PID 4692 wrote to memory of 3408 4692 8712.tmp 90 PID 4692 wrote to memory of 3408 4692 8712.tmp 90 PID 4692 wrote to memory of 3408 4692 8712.tmp 90 PID 3408 wrote to memory of 2172 3408 87AE.tmp 91 PID 3408 wrote to memory of 2172 3408 87AE.tmp 91 PID 3408 wrote to memory of 2172 3408 87AE.tmp 91 PID 2172 wrote to memory of 3080 2172 88A8.tmp 92 PID 2172 wrote to memory of 3080 2172 88A8.tmp 92 PID 2172 wrote to memory of 3080 2172 88A8.tmp 92 PID 3080 wrote to memory of 1508 3080 8954.tmp 93 PID 3080 wrote to memory of 1508 3080 8954.tmp 93 PID 3080 wrote to memory of 1508 3080 8954.tmp 93 PID 1508 wrote to memory of 4860 1508 8A3E.tmp 94 PID 1508 wrote to memory of 4860 1508 8A3E.tmp 94 PID 1508 wrote to memory of 4860 1508 8A3E.tmp 94 PID 4860 wrote to memory of 3648 4860 8B48.tmp 95 PID 4860 wrote to memory of 3648 4860 8B48.tmp 95 PID 4860 wrote to memory of 3648 4860 8B48.tmp 95 PID 3648 wrote to memory of 232 3648 8C23.tmp 98 PID 3648 wrote to memory of 232 3648 8C23.tmp 98 PID 3648 wrote to memory of 232 3648 8C23.tmp 98 PID 232 wrote to memory of 3724 232 8CAF.tmp 99 PID 232 wrote to memory of 3724 232 8CAF.tmp 99 PID 232 wrote to memory of 3724 232 8CAF.tmp 99 PID 3724 wrote to memory of 4612 3724 8D7B.tmp 100 PID 3724 wrote to memory of 4612 3724 8D7B.tmp 100 PID 3724 wrote to memory of 4612 3724 8D7B.tmp 100 PID 4612 wrote to memory of 4940 4612 8E65.tmp 101 PID 4612 wrote to memory of 4940 4612 8E65.tmp 101 PID 4612 wrote to memory of 4940 4612 8E65.tmp 101 PID 4940 wrote to memory of 2736 4940 8F30.tmp 102 PID 4940 wrote to memory of 2736 4940 8F30.tmp 102 PID 4940 wrote to memory of 2736 4940 8F30.tmp 102 PID 2736 wrote to memory of 3308 2736 902A.tmp 103 PID 2736 wrote to memory of 3308 2736 902A.tmp 103 PID 2736 wrote to memory of 3308 2736 902A.tmp 103 PID 3308 wrote to memory of 4728 3308 90D6.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\131ed64a777ca27fe6e8488a2bb9dbda_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\131ed64a777ca27fe6e8488a2bb9dbda_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\856C.tmp"C:\Users\Admin\AppData\Local\Temp\856C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"23⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"24⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"25⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"26⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"27⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"28⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"29⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"30⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"31⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"32⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"33⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"34⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"35⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"36⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"37⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"38⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"39⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"40⤵
- Executes dropped EXE
PID:780 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"41⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"42⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"43⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"44⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"45⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"46⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"47⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"48⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"49⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"50⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"51⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"52⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"53⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"54⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"55⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"56⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"57⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"58⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"59⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"60⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"61⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"62⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"63⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"64⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"65⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"66⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"67⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"68⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"69⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"70⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"71⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"72⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"73⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"74⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"75⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"76⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"77⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"78⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"79⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"80⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"81⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"82⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"83⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"84⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"85⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"86⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"87⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"88⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"89⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"90⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"91⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"92⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"93⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"94⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"95⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"96⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"97⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"98⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"99⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"100⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"101⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"102⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"103⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"104⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"105⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"106⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"107⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"108⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"109⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"110⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"111⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"112⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"113⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"114⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"115⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"116⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"117⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"118⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"119⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"120⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"121⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\C822.tmp"C:\Users\Admin\AppData\Local\Temp\C822.tmp"122⤵PID:5072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-