Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 15:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5b4f9a0e13d9db0368864c2b1e5b3f5a_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5b4f9a0e13d9db0368864c2b1e5b3f5a_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
5b4f9a0e13d9db0368864c2b1e5b3f5a_mafia_JC.exe
-
Size
488KB
-
MD5
5b4f9a0e13d9db0368864c2b1e5b3f5a
-
SHA1
dfdfb7a00fb55ea67dd873216d3c7195cd28e87e
-
SHA256
54ca27bd8b2aab50f830b61f7494641ef309b5400d31a94b2221ded56ea7ed6c
-
SHA512
fa309ff4620d30e2e60400d72a43f28ec9a96ef5472da3d2383096ba0131abf5bd26e7eed500b1f14c52220503ed43717011dec5d4fc7d76c223ba052c64c92b
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7N8wJGQ4NAcSxMwsPx2lAzNyutouQesnjZL1k:/U5rCOTeiDoZWZxK2AzDtYnjriNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2292 76C6.tmp 3440 77B0.tmp 2584 787C.tmp 3392 7956.tmp 1916 7A21.tmp 4156 7AED.tmp 4876 7B89.tmp 1728 7C35.tmp 1372 7D1F.tmp 2864 7DDB.tmp 1920 7E77.tmp 3096 7FA0.tmp 3028 80A9.tmp 2092 8155.tmp 1680 81F1.tmp 4032 82AD.tmp 1268 831A.tmp 3260 8434.tmp 4604 84DF.tmp 4304 858B.tmp 1416 8676.tmp 2520 8731.tmp 1584 87AE.tmp 4696 8889.tmp 1468 8916.tmp 4440 89B2.tmp 3108 8A7D.tmp 3860 8B48.tmp 3076 8BE4.tmp 4920 8CA0.tmp 3452 8D4C.tmp 3196 8DE8.tmp 468 8EC3.tmp 2780 8F30.tmp 3456 8FDC.tmp 1744 9069.tmp 2176 9105.tmp 3468 91A1.tmp 3880 921E.tmp 4884 92BA.tmp 3864 9347.tmp 2680 93B4.tmp 2916 9441.tmp 2880 94AE.tmp 4120 955A.tmp 1076 95F6.tmp 4136 9683.tmp 2700 971F.tmp 2828 97AC.tmp 4224 9877.tmp 4196 9913.tmp 1560 99A0.tmp 892 9A1D.tmp 2756 9A9A.tmp 2228 9B27.tmp 4320 9BB3.tmp 4976 9C40.tmp 1956 9CDC.tmp 2928 9D88.tmp 4828 9E34.tmp 2524 9EB1.tmp 1232 9F3D.tmp 1652 9FCA.tmp 3988 A028.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3764 wrote to memory of 2292 3764 5b4f9a0e13d9db0368864c2b1e5b3f5a_mafia_JC.exe 81 PID 3764 wrote to memory of 2292 3764 5b4f9a0e13d9db0368864c2b1e5b3f5a_mafia_JC.exe 81 PID 3764 wrote to memory of 2292 3764 5b4f9a0e13d9db0368864c2b1e5b3f5a_mafia_JC.exe 81 PID 2292 wrote to memory of 3440 2292 76C6.tmp 82 PID 2292 wrote to memory of 3440 2292 76C6.tmp 82 PID 2292 wrote to memory of 3440 2292 76C6.tmp 82 PID 3440 wrote to memory of 2584 3440 77B0.tmp 83 PID 3440 wrote to memory of 2584 3440 77B0.tmp 83 PID 3440 wrote to memory of 2584 3440 77B0.tmp 83 PID 2584 wrote to memory of 3392 2584 787C.tmp 84 PID 2584 wrote to memory of 3392 2584 787C.tmp 84 PID 2584 wrote to memory of 3392 2584 787C.tmp 84 PID 3392 wrote to memory of 1916 3392 7956.tmp 85 PID 3392 wrote to memory of 1916 3392 7956.tmp 85 PID 3392 wrote to memory of 1916 3392 7956.tmp 85 PID 1916 wrote to memory of 4156 1916 7A21.tmp 86 PID 1916 wrote to memory of 4156 1916 7A21.tmp 86 PID 1916 wrote to memory of 4156 1916 7A21.tmp 86 PID 4156 wrote to memory of 4876 4156 7AED.tmp 87 PID 4156 wrote to memory of 4876 4156 7AED.tmp 87 PID 4156 wrote to memory of 4876 4156 7AED.tmp 87 PID 4876 wrote to memory of 1728 4876 7B89.tmp 88 PID 4876 wrote to memory of 1728 4876 7B89.tmp 88 PID 4876 wrote to memory of 1728 4876 7B89.tmp 88 PID 1728 wrote to memory of 1372 1728 7C35.tmp 90 PID 1728 wrote to memory of 1372 1728 7C35.tmp 90 PID 1728 wrote to memory of 1372 1728 7C35.tmp 90 PID 1372 wrote to memory of 2864 1372 7D1F.tmp 91 PID 1372 wrote to memory of 2864 1372 7D1F.tmp 91 PID 1372 wrote to memory of 2864 1372 7D1F.tmp 91 PID 2864 wrote to memory of 1920 2864 7DDB.tmp 92 PID 2864 wrote to memory of 1920 2864 7DDB.tmp 92 PID 2864 wrote to memory of 1920 2864 7DDB.tmp 92 PID 1920 wrote to memory of 3096 1920 7E77.tmp 93 PID 1920 wrote to memory of 3096 1920 7E77.tmp 93 PID 1920 wrote to memory of 3096 1920 7E77.tmp 93 PID 3096 wrote to memory of 3028 3096 7FA0.tmp 94 PID 3096 wrote to memory of 3028 3096 7FA0.tmp 94 PID 3096 wrote to memory of 3028 3096 7FA0.tmp 94 PID 3028 wrote to memory of 2092 3028 80A9.tmp 95 PID 3028 wrote to memory of 2092 3028 80A9.tmp 95 PID 3028 wrote to memory of 2092 3028 80A9.tmp 95 PID 2092 wrote to memory of 1680 2092 8155.tmp 96 PID 2092 wrote to memory of 1680 2092 8155.tmp 96 PID 2092 wrote to memory of 1680 2092 8155.tmp 96 PID 1680 wrote to memory of 4032 1680 81F1.tmp 97 PID 1680 wrote to memory of 4032 1680 81F1.tmp 97 PID 1680 wrote to memory of 4032 1680 81F1.tmp 97 PID 4032 wrote to memory of 1268 4032 82AD.tmp 100 PID 4032 wrote to memory of 1268 4032 82AD.tmp 100 PID 4032 wrote to memory of 1268 4032 82AD.tmp 100 PID 1268 wrote to memory of 3260 1268 831A.tmp 101 PID 1268 wrote to memory of 3260 1268 831A.tmp 101 PID 1268 wrote to memory of 3260 1268 831A.tmp 101 PID 3260 wrote to memory of 4604 3260 8434.tmp 102 PID 3260 wrote to memory of 4604 3260 8434.tmp 102 PID 3260 wrote to memory of 4604 3260 8434.tmp 102 PID 4604 wrote to memory of 4304 4604 84DF.tmp 103 PID 4604 wrote to memory of 4304 4604 84DF.tmp 103 PID 4604 wrote to memory of 4304 4604 84DF.tmp 103 PID 4304 wrote to memory of 1416 4304 858B.tmp 104 PID 4304 wrote to memory of 1416 4304 858B.tmp 104 PID 4304 wrote to memory of 1416 4304 858B.tmp 104 PID 1416 wrote to memory of 2520 1416 8676.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b4f9a0e13d9db0368864c2b1e5b3f5a_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\5b4f9a0e13d9db0368864c2b1e5b3f5a_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"23⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"24⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"25⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"26⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"27⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"28⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"29⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"30⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"31⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"32⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"33⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"34⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"35⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"36⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"37⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"38⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"39⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"40⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"41⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"42⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"43⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"44⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"45⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"46⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"47⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"48⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"49⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"50⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"51⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"52⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"53⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"54⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"55⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"56⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"57⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"58⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"59⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"60⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"61⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"62⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"63⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"64⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"65⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"66⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"67⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"68⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"69⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"70⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"71⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"72⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"73⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"74⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"75⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"76⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"77⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"78⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"79⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"80⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"81⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"82⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"83⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"84⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"85⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"86⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"87⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"88⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"89⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"90⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"91⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"92⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"93⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"94⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"95⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"96⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"97⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"98⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"99⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"100⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"101⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"102⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"103⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"104⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"105⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"106⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"107⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"108⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"109⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"110⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"111⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"112⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"113⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"114⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"115⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"116⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"117⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"118⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"119⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"120⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"121⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"122⤵PID:1800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-