Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2023, 13:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
24f7f08a456b55961de2f1564a59a3f2_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
24f7f08a456b55961de2f1564a59a3f2_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
24f7f08a456b55961de2f1564a59a3f2_mafia_JC.exe
-
Size
488KB
-
MD5
24f7f08a456b55961de2f1564a59a3f2
-
SHA1
79d701586b4ba126530014b04d000f452c3c8b52
-
SHA256
a5c6f1a1d29e091322296132a3e0a5459607f676c05091ecb06ed75e3e4f1d76
-
SHA512
0a83e8500cc023b73e6f3b438d621fd275baf52852c3b656be7d206aba87791a9dd87ba96b6ff0a7bac8cb1a7406dc2fc685968cd01c6098cc79373cfa17f575
-
SSDEEP
12288:/U5rCOTeiDh4u03IlOaMeLLiY4D+jwNZ:/UQOJDaui4LWY4DhN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3300 67E2.tmp 3344 68DC.tmp 456 69E5.tmp 2224 6ADF.tmp 1200 6B8B.tmp 3916 6C75.tmp 3972 6D6F.tmp 1148 6E1B.tmp 1452 6ED7.tmp 4464 6F83.tmp 1388 707D.tmp 1380 7138.tmp 3900 7232.tmp 3800 730D.tmp 1164 7407.tmp 540 74F1.tmp 4980 75CC.tmp 436 7678.tmp 2308 7753.tmp 2368 781E.tmp 4568 78CA.tmp 2284 7966.tmp 2860 79E3.tmp 1984 7ACD.tmp 3260 7BF6.tmp 2444 7CA2.tmp 2020 7D5E.tmp 2624 7E09.tmp 3980 7EF4.tmp 724 7F90.tmp 368 806B.tmp 1068 8107.tmp 4004 81C3.tmp 4868 8230.tmp 4352 82CC.tmp 3840 8349.tmp 1800 83C6.tmp 628 8443.tmp 3968 84A1.tmp 2736 851E.tmp 2340 85AB.tmp 5068 8656.tmp 1596 86D3.tmp 4876 8741.tmp 2400 87DD.tmp 4108 8889.tmp 2436 8935.tmp 1492 89C1.tmp 2032 8A3E.tmp 2868 8ADB.tmp 5052 8B58.tmp 4844 8BD5.tmp 1912 8C42.tmp 1980 8CBF.tmp 3344 8D2C.tmp 2180 8DB9.tmp 1500 8E36.tmp 4144 8EB3.tmp 4576 8F20.tmp 3720 8FCC.tmp 4392 9069.tmp 3520 9105.tmp 2228 91A1.tmp 3828 923D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4128 wrote to memory of 3300 4128 24f7f08a456b55961de2f1564a59a3f2_mafia_JC.exe 83 PID 4128 wrote to memory of 3300 4128 24f7f08a456b55961de2f1564a59a3f2_mafia_JC.exe 83 PID 4128 wrote to memory of 3300 4128 24f7f08a456b55961de2f1564a59a3f2_mafia_JC.exe 83 PID 3300 wrote to memory of 3344 3300 67E2.tmp 84 PID 3300 wrote to memory of 3344 3300 67E2.tmp 84 PID 3300 wrote to memory of 3344 3300 67E2.tmp 84 PID 3344 wrote to memory of 456 3344 68DC.tmp 85 PID 3344 wrote to memory of 456 3344 68DC.tmp 85 PID 3344 wrote to memory of 456 3344 68DC.tmp 85 PID 456 wrote to memory of 2224 456 69E5.tmp 86 PID 456 wrote to memory of 2224 456 69E5.tmp 86 PID 456 wrote to memory of 2224 456 69E5.tmp 86 PID 2224 wrote to memory of 1200 2224 6ADF.tmp 87 PID 2224 wrote to memory of 1200 2224 6ADF.tmp 87 PID 2224 wrote to memory of 1200 2224 6ADF.tmp 87 PID 1200 wrote to memory of 3916 1200 6B8B.tmp 88 PID 1200 wrote to memory of 3916 1200 6B8B.tmp 88 PID 1200 wrote to memory of 3916 1200 6B8B.tmp 88 PID 3916 wrote to memory of 3972 3916 6C75.tmp 89 PID 3916 wrote to memory of 3972 3916 6C75.tmp 89 PID 3916 wrote to memory of 3972 3916 6C75.tmp 89 PID 3972 wrote to memory of 1148 3972 6D6F.tmp 90 PID 3972 wrote to memory of 1148 3972 6D6F.tmp 90 PID 3972 wrote to memory of 1148 3972 6D6F.tmp 90 PID 1148 wrote to memory of 1452 1148 6E1B.tmp 91 PID 1148 wrote to memory of 1452 1148 6E1B.tmp 91 PID 1148 wrote to memory of 1452 1148 6E1B.tmp 91 PID 1452 wrote to memory of 4464 1452 6ED7.tmp 93 PID 1452 wrote to memory of 4464 1452 6ED7.tmp 93 PID 1452 wrote to memory of 4464 1452 6ED7.tmp 93 PID 4464 wrote to memory of 1388 4464 6F83.tmp 94 PID 4464 wrote to memory of 1388 4464 6F83.tmp 94 PID 4464 wrote to memory of 1388 4464 6F83.tmp 94 PID 1388 wrote to memory of 1380 1388 707D.tmp 95 PID 1388 wrote to memory of 1380 1388 707D.tmp 95 PID 1388 wrote to memory of 1380 1388 707D.tmp 95 PID 1380 wrote to memory of 3900 1380 7138.tmp 96 PID 1380 wrote to memory of 3900 1380 7138.tmp 96 PID 1380 wrote to memory of 3900 1380 7138.tmp 96 PID 3900 wrote to memory of 3800 3900 7232.tmp 97 PID 3900 wrote to memory of 3800 3900 7232.tmp 97 PID 3900 wrote to memory of 3800 3900 7232.tmp 97 PID 3800 wrote to memory of 1164 3800 730D.tmp 98 PID 3800 wrote to memory of 1164 3800 730D.tmp 98 PID 3800 wrote to memory of 1164 3800 730D.tmp 98 PID 1164 wrote to memory of 540 1164 7407.tmp 99 PID 1164 wrote to memory of 540 1164 7407.tmp 99 PID 1164 wrote to memory of 540 1164 7407.tmp 99 PID 540 wrote to memory of 4980 540 74F1.tmp 100 PID 540 wrote to memory of 4980 540 74F1.tmp 100 PID 540 wrote to memory of 4980 540 74F1.tmp 100 PID 4980 wrote to memory of 436 4980 75CC.tmp 101 PID 4980 wrote to memory of 436 4980 75CC.tmp 101 PID 4980 wrote to memory of 436 4980 75CC.tmp 101 PID 436 wrote to memory of 2308 436 7678.tmp 102 PID 436 wrote to memory of 2308 436 7678.tmp 102 PID 436 wrote to memory of 2308 436 7678.tmp 102 PID 2308 wrote to memory of 2368 2308 7753.tmp 103 PID 2308 wrote to memory of 2368 2308 7753.tmp 103 PID 2308 wrote to memory of 2368 2308 7753.tmp 103 PID 2368 wrote to memory of 4568 2368 781E.tmp 104 PID 2368 wrote to memory of 4568 2368 781E.tmp 104 PID 2368 wrote to memory of 4568 2368 781E.tmp 104 PID 4568 wrote to memory of 2284 4568 78CA.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\24f7f08a456b55961de2f1564a59a3f2_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\24f7f08a456b55961de2f1564a59a3f2_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"23⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"24⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"25⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"26⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"27⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"28⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"29⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"30⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"31⤵
- Executes dropped EXE
PID:724 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"32⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"33⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"34⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"35⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"36⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"37⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"38⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"39⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"40⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"41⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"42⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"43⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"44⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"45⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"46⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"47⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"48⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"49⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"50⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"51⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"52⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"53⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"54⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"55⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"56⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"57⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"58⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"59⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"60⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"61⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"62⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"63⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"64⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"65⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"66⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"67⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"68⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"69⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"70⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"71⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"72⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"73⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"74⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"75⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"76⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"77⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"78⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"79⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"80⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"81⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"82⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"83⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"84⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"85⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"86⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"87⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"88⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"89⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"90⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"91⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"92⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"93⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"94⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"95⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"96⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"97⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"98⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"99⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"100⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"101⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"102⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"103⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"104⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"105⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"106⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"107⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"108⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"109⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"110⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"111⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"112⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"113⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"114⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"115⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"116⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"117⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"118⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"119⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"120⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"121⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"122⤵PID:3596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-