Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2023, 14:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2a73a8304e22ba76ef446c60ce2ddd32_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2a73a8304e22ba76ef446c60ce2ddd32_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
2a73a8304e22ba76ef446c60ce2ddd32_mafia_JC.exe
-
Size
520KB
-
MD5
2a73a8304e22ba76ef446c60ce2ddd32
-
SHA1
2bfe249fdb4471863066fa021da5575cc49be94c
-
SHA256
448745a1e38104841ef57aeb08847fbb4891259c90ec1ad9d21afcb56c3592b9
-
SHA512
19eeb157c0121d667abc39016d16b337d23d8cf45e74cbdb750b45a6b54a15bfc57bef91435e69882547c423470a0d0819637985882c5a2f572b124d91ce6854
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLgkVuVuTz4LvKKTdAZCsZVzX545LI3sgl5KuHa:roRXOQjmOyXVu6z4LvKgmPZVb5J6NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 696 6A04.tmp 4384 6AA1.tmp 2852 6B4D.tmp 2152 6C08.tmp 4880 6CA4.tmp 4048 6D41.tmp 2536 6DFC.tmp 4912 6E98.tmp 4884 6F15.tmp 4456 6FA2.tmp 4440 702F.tmp 4832 7119.tmp 5104 71D4.tmp 5028 72AF.tmp 4100 735B.tmp 3372 7417.tmp 3832 74E2.tmp 4904 756E.tmp 1744 760B.tmp 4560 76A7.tmp 3312 7791.tmp 1748 782D.tmp 4380 79F3.tmp 464 7A8F.tmp 4968 7B3B.tmp 4676 7C92.tmp 1996 7D1F.tmp 1540 7DDB.tmp 4336 7E86.tmp 1736 7F71.tmp 3788 803C.tmp 2820 8117.tmp 4992 81C3.tmp 1292 826E.tmp 4708 830B.tmp 1708 8397.tmp 4208 8414.tmp 4612 8491.tmp 1552 852E.tmp 1968 859B.tmp 3368 8628.tmp 4144 86D3.tmp 720 8741.tmp 2200 87DD.tmp 4228 8889.tmp 3352 8935.tmp 2472 89B2.tmp 1428 8A10.tmp 3280 8ABB.tmp 3024 8B58.tmp 3728 8BD5.tmp 3192 8C61.tmp 2716 8CDE.tmp 2856 8D7B.tmp 4576 8E07.tmp 820 8EE2.tmp 1304 8F4F.tmp 4288 8FDC.tmp 4924 9088.tmp 456 9105.tmp 1460 9182.tmp 4580 921E.tmp 1020 928B.tmp 4524 9328.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4548 wrote to memory of 696 4548 2a73a8304e22ba76ef446c60ce2ddd32_mafia_JC.exe 81 PID 4548 wrote to memory of 696 4548 2a73a8304e22ba76ef446c60ce2ddd32_mafia_JC.exe 81 PID 4548 wrote to memory of 696 4548 2a73a8304e22ba76ef446c60ce2ddd32_mafia_JC.exe 81 PID 696 wrote to memory of 4384 696 6A04.tmp 82 PID 696 wrote to memory of 4384 696 6A04.tmp 82 PID 696 wrote to memory of 4384 696 6A04.tmp 82 PID 4384 wrote to memory of 2852 4384 6AA1.tmp 83 PID 4384 wrote to memory of 2852 4384 6AA1.tmp 83 PID 4384 wrote to memory of 2852 4384 6AA1.tmp 83 PID 2852 wrote to memory of 2152 2852 6B4D.tmp 84 PID 2852 wrote to memory of 2152 2852 6B4D.tmp 84 PID 2852 wrote to memory of 2152 2852 6B4D.tmp 84 PID 2152 wrote to memory of 4880 2152 6C08.tmp 85 PID 2152 wrote to memory of 4880 2152 6C08.tmp 85 PID 2152 wrote to memory of 4880 2152 6C08.tmp 85 PID 4880 wrote to memory of 4048 4880 6CA4.tmp 86 PID 4880 wrote to memory of 4048 4880 6CA4.tmp 86 PID 4880 wrote to memory of 4048 4880 6CA4.tmp 86 PID 4048 wrote to memory of 2536 4048 6D41.tmp 87 PID 4048 wrote to memory of 2536 4048 6D41.tmp 87 PID 4048 wrote to memory of 2536 4048 6D41.tmp 87 PID 2536 wrote to memory of 4912 2536 6DFC.tmp 88 PID 2536 wrote to memory of 4912 2536 6DFC.tmp 88 PID 2536 wrote to memory of 4912 2536 6DFC.tmp 88 PID 4912 wrote to memory of 4884 4912 6E98.tmp 90 PID 4912 wrote to memory of 4884 4912 6E98.tmp 90 PID 4912 wrote to memory of 4884 4912 6E98.tmp 90 PID 4884 wrote to memory of 4456 4884 6F15.tmp 91 PID 4884 wrote to memory of 4456 4884 6F15.tmp 91 PID 4884 wrote to memory of 4456 4884 6F15.tmp 91 PID 4456 wrote to memory of 4440 4456 6FA2.tmp 92 PID 4456 wrote to memory of 4440 4456 6FA2.tmp 92 PID 4456 wrote to memory of 4440 4456 6FA2.tmp 92 PID 4440 wrote to memory of 4832 4440 702F.tmp 93 PID 4440 wrote to memory of 4832 4440 702F.tmp 93 PID 4440 wrote to memory of 4832 4440 702F.tmp 93 PID 4832 wrote to memory of 5104 4832 7119.tmp 94 PID 4832 wrote to memory of 5104 4832 7119.tmp 94 PID 4832 wrote to memory of 5104 4832 7119.tmp 94 PID 5104 wrote to memory of 5028 5104 71D4.tmp 95 PID 5104 wrote to memory of 5028 5104 71D4.tmp 95 PID 5104 wrote to memory of 5028 5104 71D4.tmp 95 PID 5028 wrote to memory of 4100 5028 72AF.tmp 96 PID 5028 wrote to memory of 4100 5028 72AF.tmp 96 PID 5028 wrote to memory of 4100 5028 72AF.tmp 96 PID 4100 wrote to memory of 3372 4100 735B.tmp 97 PID 4100 wrote to memory of 3372 4100 735B.tmp 97 PID 4100 wrote to memory of 3372 4100 735B.tmp 97 PID 3372 wrote to memory of 3832 3372 7417.tmp 98 PID 3372 wrote to memory of 3832 3372 7417.tmp 98 PID 3372 wrote to memory of 3832 3372 7417.tmp 98 PID 3832 wrote to memory of 4904 3832 74E2.tmp 99 PID 3832 wrote to memory of 4904 3832 74E2.tmp 99 PID 3832 wrote to memory of 4904 3832 74E2.tmp 99 PID 4904 wrote to memory of 1744 4904 756E.tmp 100 PID 4904 wrote to memory of 1744 4904 756E.tmp 100 PID 4904 wrote to memory of 1744 4904 756E.tmp 100 PID 1744 wrote to memory of 4560 1744 760B.tmp 101 PID 1744 wrote to memory of 4560 1744 760B.tmp 101 PID 1744 wrote to memory of 4560 1744 760B.tmp 101 PID 4560 wrote to memory of 3312 4560 76A7.tmp 102 PID 4560 wrote to memory of 3312 4560 76A7.tmp 102 PID 4560 wrote to memory of 3312 4560 76A7.tmp 102 PID 3312 wrote to memory of 1748 3312 7791.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a73a8304e22ba76ef446c60ce2ddd32_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2a73a8304e22ba76ef446c60ce2ddd32_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"23⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"24⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"25⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"26⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"27⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"28⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"29⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"30⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"31⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"32⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"33⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"34⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"35⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"36⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"37⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"38⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"39⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"40⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"41⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"42⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"43⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"44⤵
- Executes dropped EXE
PID:720 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"45⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"46⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"47⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"48⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"49⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"50⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"51⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"52⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"53⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"54⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"55⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"56⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"57⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"58⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"59⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"60⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"61⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"62⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"63⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"64⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"65⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"66⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"67⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"68⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"69⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"70⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"71⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"72⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"73⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"74⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"75⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"76⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"77⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"78⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"79⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"80⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"81⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"82⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"83⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"84⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"85⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"86⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"87⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"88⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"89⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"90⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"91⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"92⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"93⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"94⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"95⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"96⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"97⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"98⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"99⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"100⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"101⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"102⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"103⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"104⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"105⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"106⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"107⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"108⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"109⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"110⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"111⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"112⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"113⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"114⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"115⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"116⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"117⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"118⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"119⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"120⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"121⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"122⤵PID:2356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-