Analysis
-
max time kernel
151s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2023, 11:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d99d14e782bdc0a4f6676489e10af2f_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
8d99d14e782bdc0a4f6676489e10af2f_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
8d99d14e782bdc0a4f6676489e10af2f_mafia_JC.exe
-
Size
486KB
-
MD5
8d99d14e782bdc0a4f6676489e10af2f
-
SHA1
825bb19c8231b80ccc4d0dd0984748f29f3a6ec5
-
SHA256
004c3d37b70e8b8b1bd835d81eca20eca2a6d0eb71806c1ab2de9af0a903a8d9
-
SHA512
7eee92988475eb94b0739f6c6980ff180c1317f265ba9c5c4adb7007fdac484af0a62424ffe8259b298afcdc90ad5541071ed602b7abfc65710c0cddef420800
-
SSDEEP
12288:/U5rCOTeiDUhTjii/unlEGyiF8RrX1hzPyNZ:/UQOJDUhTmLkyGhzaN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4596 E956.tmp 1104 EA31.tmp 2956 EADD.tmp 2664 EBD7.tmp 5004 EC92.tmp 680 ED9C.tmp 1684 EE48.tmp 1020 EEE4.tmp 1152 EFCE.tmp 3772 F08A.tmp 4392 F165.tmp 4892 F211.tmp 2696 F2AD.tmp 4152 F368.tmp 1688 F462.tmp 2776 F54D.tmp 3560 F637.tmp 1980 F6E3.tmp 2516 F7BE.tmp 4888 F8B8.tmp 4160 F983.tmp 1872 FA2F.tmp 2724 FAFA.tmp 368 FB86.tmp 1140 FC42.tmp 1984 FCEE.tmp 1348 FDA9.tmp 4352 FE46.tmp 888 FED2.tmp 1756 FF7E.tmp 3220 3A.tmp 4404 134.tmp 1596 1DF.tmp 1800 27C.tmp 656 318.tmp 2788 3B4.tmp 4644 450.tmp 4460 4BE.tmp 4348 53B.tmp 3248 5D7.tmp 3728 673.tmp 4316 6F0.tmp 2236 76D.tmp 4100 7EA.tmp 3456 877.tmp 4276 904.tmp 4248 990.tmp 3016 A2C.tmp 2524 A9A.tmp 3552 B46.tmp 1328 BB3.tmp 3976 C20.tmp 5088 CBD.tmp 1088 D59.tmp 4596 DD6.tmp 4268 E63.tmp 812 EEF.tmp 2956 F8B.tmp 528 1028.tmp 1792 10C4.tmp 4972 1170.tmp 4376 120C.tmp 3024 1299.tmp 4256 1335.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 112 wrote to memory of 4596 112 8d99d14e782bdc0a4f6676489e10af2f_mafia_JC.exe 83 PID 112 wrote to memory of 4596 112 8d99d14e782bdc0a4f6676489e10af2f_mafia_JC.exe 83 PID 112 wrote to memory of 4596 112 8d99d14e782bdc0a4f6676489e10af2f_mafia_JC.exe 83 PID 4596 wrote to memory of 1104 4596 E956.tmp 84 PID 4596 wrote to memory of 1104 4596 E956.tmp 84 PID 4596 wrote to memory of 1104 4596 E956.tmp 84 PID 1104 wrote to memory of 2956 1104 EA31.tmp 85 PID 1104 wrote to memory of 2956 1104 EA31.tmp 85 PID 1104 wrote to memory of 2956 1104 EA31.tmp 85 PID 2956 wrote to memory of 2664 2956 EADD.tmp 86 PID 2956 wrote to memory of 2664 2956 EADD.tmp 86 PID 2956 wrote to memory of 2664 2956 EADD.tmp 86 PID 2664 wrote to memory of 5004 2664 EBD7.tmp 87 PID 2664 wrote to memory of 5004 2664 EBD7.tmp 87 PID 2664 wrote to memory of 5004 2664 EBD7.tmp 87 PID 5004 wrote to memory of 680 5004 EC92.tmp 88 PID 5004 wrote to memory of 680 5004 EC92.tmp 88 PID 5004 wrote to memory of 680 5004 EC92.tmp 88 PID 680 wrote to memory of 1684 680 ED9C.tmp 89 PID 680 wrote to memory of 1684 680 ED9C.tmp 89 PID 680 wrote to memory of 1684 680 ED9C.tmp 89 PID 1684 wrote to memory of 1020 1684 EE48.tmp 90 PID 1684 wrote to memory of 1020 1684 EE48.tmp 90 PID 1684 wrote to memory of 1020 1684 EE48.tmp 90 PID 1020 wrote to memory of 1152 1020 EEE4.tmp 91 PID 1020 wrote to memory of 1152 1020 EEE4.tmp 91 PID 1020 wrote to memory of 1152 1020 EEE4.tmp 91 PID 1152 wrote to memory of 3772 1152 EFCE.tmp 92 PID 1152 wrote to memory of 3772 1152 EFCE.tmp 92 PID 1152 wrote to memory of 3772 1152 EFCE.tmp 92 PID 3772 wrote to memory of 4392 3772 F08A.tmp 93 PID 3772 wrote to memory of 4392 3772 F08A.tmp 93 PID 3772 wrote to memory of 4392 3772 F08A.tmp 93 PID 4392 wrote to memory of 4892 4392 F165.tmp 94 PID 4392 wrote to memory of 4892 4392 F165.tmp 94 PID 4392 wrote to memory of 4892 4392 F165.tmp 94 PID 4892 wrote to memory of 2696 4892 F211.tmp 95 PID 4892 wrote to memory of 2696 4892 F211.tmp 95 PID 4892 wrote to memory of 2696 4892 F211.tmp 95 PID 2696 wrote to memory of 4152 2696 F2AD.tmp 96 PID 2696 wrote to memory of 4152 2696 F2AD.tmp 96 PID 2696 wrote to memory of 4152 2696 F2AD.tmp 96 PID 4152 wrote to memory of 1688 4152 F368.tmp 97 PID 4152 wrote to memory of 1688 4152 F368.tmp 97 PID 4152 wrote to memory of 1688 4152 F368.tmp 97 PID 1688 wrote to memory of 2776 1688 F462.tmp 98 PID 1688 wrote to memory of 2776 1688 F462.tmp 98 PID 1688 wrote to memory of 2776 1688 F462.tmp 98 PID 2776 wrote to memory of 3560 2776 F54D.tmp 99 PID 2776 wrote to memory of 3560 2776 F54D.tmp 99 PID 2776 wrote to memory of 3560 2776 F54D.tmp 99 PID 3560 wrote to memory of 1980 3560 F637.tmp 100 PID 3560 wrote to memory of 1980 3560 F637.tmp 100 PID 3560 wrote to memory of 1980 3560 F637.tmp 100 PID 1980 wrote to memory of 2516 1980 F6E3.tmp 103 PID 1980 wrote to memory of 2516 1980 F6E3.tmp 103 PID 1980 wrote to memory of 2516 1980 F6E3.tmp 103 PID 2516 wrote to memory of 4888 2516 F7BE.tmp 104 PID 2516 wrote to memory of 4888 2516 F7BE.tmp 104 PID 2516 wrote to memory of 4888 2516 F7BE.tmp 104 PID 4888 wrote to memory of 4160 4888 F8B8.tmp 105 PID 4888 wrote to memory of 4160 4888 F8B8.tmp 105 PID 4888 wrote to memory of 4160 4888 F8B8.tmp 105 PID 4160 wrote to memory of 1872 4160 F983.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d99d14e782bdc0a4f6676489e10af2f_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\8d99d14e782bdc0a4f6676489e10af2f_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\EA31.tmp"C:\Users\Admin\AppData\Local\Temp\EA31.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\EADD.tmp"C:\Users\Admin\AppData\Local\Temp\EADD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\EC92.tmp"C:\Users\Admin\AppData\Local\Temp\EC92.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\EE48.tmp"C:\Users\Admin\AppData\Local\Temp\EE48.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\F165.tmp"C:\Users\Admin\AppData\Local\Temp\F165.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\F462.tmp"C:\Users\Admin\AppData\Local\Temp\F462.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\F637.tmp"C:\Users\Admin\AppData\Local\Temp\F637.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\F983.tmp"C:\Users\Admin\AppData\Local\Temp\F983.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"23⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"24⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\FB86.tmp"C:\Users\Admin\AppData\Local\Temp\FB86.tmp"25⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"26⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"27⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"28⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\FE46.tmp"C:\Users\Admin\AppData\Local\Temp\FE46.tmp"29⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\FED2.tmp"C:\Users\Admin\AppData\Local\Temp\FED2.tmp"30⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"31⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A.tmp"32⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"33⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\1DF.tmp"C:\Users\Admin\AppData\Local\Temp\1DF.tmp"34⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"35⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\318.tmp"C:\Users\Admin\AppData\Local\Temp\318.tmp"36⤵
- Executes dropped EXE
PID:656 -
C:\Users\Admin\AppData\Local\Temp\3B4.tmp"C:\Users\Admin\AppData\Local\Temp\3B4.tmp"37⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\450.tmp"C:\Users\Admin\AppData\Local\Temp\450.tmp"38⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\4BE.tmp"C:\Users\Admin\AppData\Local\Temp\4BE.tmp"39⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\53B.tmp"C:\Users\Admin\AppData\Local\Temp\53B.tmp"40⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"41⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\673.tmp"C:\Users\Admin\AppData\Local\Temp\673.tmp"42⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"43⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\76D.tmp"C:\Users\Admin\AppData\Local\Temp\76D.tmp"44⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"45⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"46⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"47⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"48⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"49⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"50⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"51⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"52⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\C20.tmp"C:\Users\Admin\AppData\Local\Temp\C20.tmp"53⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"54⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"55⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"56⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\E63.tmp"C:\Users\Admin\AppData\Local\Temp\E63.tmp"57⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"58⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"59⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\1028.tmp"C:\Users\Admin\AppData\Local\Temp\1028.tmp"60⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"61⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"62⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"63⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"64⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"65⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\13E1.tmp"C:\Users\Admin\AppData\Local\Temp\13E1.tmp"66⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"67⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"68⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\1529.tmp"C:\Users\Admin\AppData\Local\Temp\1529.tmp"69⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"70⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\1613.tmp"C:\Users\Admin\AppData\Local\Temp\1613.tmp"71⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"72⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\16FE.tmp"C:\Users\Admin\AppData\Local\Temp\16FE.tmp"73⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\17B9.tmp"C:\Users\Admin\AppData\Local\Temp\17B9.tmp"74⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"75⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"76⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"77⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"78⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\19FB.tmp"C:\Users\Admin\AppData\Local\Temp\19FB.tmp"79⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\1A88.tmp"C:\Users\Admin\AppData\Local\Temp\1A88.tmp"80⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"81⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"82⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"83⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"84⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"85⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"86⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\1E31.tmp"C:\Users\Admin\AppData\Local\Temp\1E31.tmp"87⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"88⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"89⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"90⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\2074.tmp"C:\Users\Admin\AppData\Local\Temp\2074.tmp"91⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\20E1.tmp"C:\Users\Admin\AppData\Local\Temp\20E1.tmp"92⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"93⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\21BC.tmp"C:\Users\Admin\AppData\Local\Temp\21BC.tmp"94⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\2248.tmp"C:\Users\Admin\AppData\Local\Temp\2248.tmp"95⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"96⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\2352.tmp"C:\Users\Admin\AppData\Local\Temp\2352.tmp"97⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\23DF.tmp"C:\Users\Admin\AppData\Local\Temp\23DF.tmp"98⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"99⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"100⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\2584.tmp"C:\Users\Admin\AppData\Local\Temp\2584.tmp"101⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"102⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\26CD.tmp"C:\Users\Admin\AppData\Local\Temp\26CD.tmp"103⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\2769.tmp"C:\Users\Admin\AppData\Local\Temp\2769.tmp"104⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"105⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\28A1.tmp"C:\Users\Admin\AppData\Local\Temp\28A1.tmp"106⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\292E.tmp"C:\Users\Admin\AppData\Local\Temp\292E.tmp"107⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\29CA.tmp"C:\Users\Admin\AppData\Local\Temp\29CA.tmp"108⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"109⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"110⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"111⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"112⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"113⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"114⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\2D74.tmp"C:\Users\Admin\AppData\Local\Temp\2D74.tmp"115⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"116⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"117⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"118⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\2F97.tmp"C:\Users\Admin\AppData\Local\Temp\2F97.tmp"119⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\3042.tmp"C:\Users\Admin\AppData\Local\Temp\3042.tmp"120⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"121⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\313C.tmp"C:\Users\Admin\AppData\Local\Temp\313C.tmp"122⤵PID:1760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-