Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 14:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ef9521f246732faaa96fb3911b850978_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ef9521f246732faaa96fb3911b850978_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
ef9521f246732faaa96fb3911b850978_mafia_JC.exe
-
Size
527KB
-
MD5
ef9521f246732faaa96fb3911b850978
-
SHA1
c611a00ff7eb14d5d6d9b6ad5f6cac464cfb010e
-
SHA256
fe9d5001089ce88209b1c5d69b41715d626629b06b29a82829c90f9eeef95be8
-
SHA512
f547bd0d45602a24f0a009dce39a7e1a61199c911daac2461e5ce8eb06ea397e3e367c675ca949acc5668ca26d9495ecbd65d186254e6462bf9f09a68e7e9002
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYeOFInwa3m/4o95mT0giaYRE61VNHWsH3zZ3+:fU5rCOTeidKyV4x95c0hRE61THnDZu
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3208 8424.tmp 4780 84D0.tmp 3776 85AB.tmp 2324 8695.tmp 4144 8750.tmp 116 87ED.tmp 2728 8889.tmp 1472 8944.tmp 4900 89E1.tmp 3020 8A4E.tmp 2852 8AEA.tmp 2364 8B96.tmp 3300 8C52.tmp 3096 8D6B.tmp 3936 8E17.tmp 3196 8ED2.tmp 4696 8F8E.tmp 1772 903A.tmp 1344 9105.tmp 828 9182.tmp 1480 928B.tmp 3080 9347.tmp 4716 93B4.tmp 1400 9470.tmp 3764 94FC.tmp 2784 95A8.tmp 4692 9635.tmp 2512 96E1.tmp 4304 976D.tmp 3016 9819.tmp 3380 98B6.tmp 4652 9990.tmp 1940 9A5B.tmp 1948 9AC9.tmp 3460 9B55.tmp 3756 9BE2.tmp 380 9C6F.tmp 1828 9CDC.tmp 4404 9D88.tmp 3576 9E24.tmp 408 9EC0.tmp 2100 9F5D.tmp 468 9FCA.tmp 400 A057.tmp 1876 A0D4.tmp 4512 A151.tmp 2200 A1CE.tmp 3208 A24B.tmp 2996 A2F7.tmp 1272 A393.tmp 1424 A41F.tmp 3956 A4AC.tmp 2324 A529.tmp 3540 A5C5.tmp 4916 A671.tmp 116 A6DF.tmp 4324 A75C.tmp 4952 A7C9.tmp 1616 A856.tmp 1724 A8D3.tmp 3052 A940.tmp 1168 A9BD.tmp 3464 AA4A.tmp 3944 AAC7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1600 wrote to memory of 3208 1600 ef9521f246732faaa96fb3911b850978_mafia_JC.exe 82 PID 1600 wrote to memory of 3208 1600 ef9521f246732faaa96fb3911b850978_mafia_JC.exe 82 PID 1600 wrote to memory of 3208 1600 ef9521f246732faaa96fb3911b850978_mafia_JC.exe 82 PID 3208 wrote to memory of 4780 3208 8424.tmp 83 PID 3208 wrote to memory of 4780 3208 8424.tmp 83 PID 3208 wrote to memory of 4780 3208 8424.tmp 83 PID 4780 wrote to memory of 3776 4780 84D0.tmp 84 PID 4780 wrote to memory of 3776 4780 84D0.tmp 84 PID 4780 wrote to memory of 3776 4780 84D0.tmp 84 PID 3776 wrote to memory of 2324 3776 85AB.tmp 85 PID 3776 wrote to memory of 2324 3776 85AB.tmp 85 PID 3776 wrote to memory of 2324 3776 85AB.tmp 85 PID 2324 wrote to memory of 4144 2324 8695.tmp 86 PID 2324 wrote to memory of 4144 2324 8695.tmp 86 PID 2324 wrote to memory of 4144 2324 8695.tmp 86 PID 4144 wrote to memory of 116 4144 8750.tmp 87 PID 4144 wrote to memory of 116 4144 8750.tmp 87 PID 4144 wrote to memory of 116 4144 8750.tmp 87 PID 116 wrote to memory of 2728 116 87ED.tmp 88 PID 116 wrote to memory of 2728 116 87ED.tmp 88 PID 116 wrote to memory of 2728 116 87ED.tmp 88 PID 2728 wrote to memory of 1472 2728 8889.tmp 89 PID 2728 wrote to memory of 1472 2728 8889.tmp 89 PID 2728 wrote to memory of 1472 2728 8889.tmp 89 PID 1472 wrote to memory of 4900 1472 8944.tmp 91 PID 1472 wrote to memory of 4900 1472 8944.tmp 91 PID 1472 wrote to memory of 4900 1472 8944.tmp 91 PID 4900 wrote to memory of 3020 4900 89E1.tmp 92 PID 4900 wrote to memory of 3020 4900 89E1.tmp 92 PID 4900 wrote to memory of 3020 4900 89E1.tmp 92 PID 3020 wrote to memory of 2852 3020 8A4E.tmp 93 PID 3020 wrote to memory of 2852 3020 8A4E.tmp 93 PID 3020 wrote to memory of 2852 3020 8A4E.tmp 93 PID 2852 wrote to memory of 2364 2852 8AEA.tmp 94 PID 2852 wrote to memory of 2364 2852 8AEA.tmp 94 PID 2852 wrote to memory of 2364 2852 8AEA.tmp 94 PID 2364 wrote to memory of 3300 2364 8B96.tmp 95 PID 2364 wrote to memory of 3300 2364 8B96.tmp 95 PID 2364 wrote to memory of 3300 2364 8B96.tmp 95 PID 3300 wrote to memory of 3096 3300 8C52.tmp 96 PID 3300 wrote to memory of 3096 3300 8C52.tmp 96 PID 3300 wrote to memory of 3096 3300 8C52.tmp 96 PID 3096 wrote to memory of 3936 3096 8D6B.tmp 97 PID 3096 wrote to memory of 3936 3096 8D6B.tmp 97 PID 3096 wrote to memory of 3936 3096 8D6B.tmp 97 PID 3936 wrote to memory of 3196 3936 8E17.tmp 98 PID 3936 wrote to memory of 3196 3936 8E17.tmp 98 PID 3936 wrote to memory of 3196 3936 8E17.tmp 98 PID 3196 wrote to memory of 4696 3196 8ED2.tmp 99 PID 3196 wrote to memory of 4696 3196 8ED2.tmp 99 PID 3196 wrote to memory of 4696 3196 8ED2.tmp 99 PID 4696 wrote to memory of 1772 4696 8F8E.tmp 102 PID 4696 wrote to memory of 1772 4696 8F8E.tmp 102 PID 4696 wrote to memory of 1772 4696 8F8E.tmp 102 PID 1772 wrote to memory of 1344 1772 903A.tmp 103 PID 1772 wrote to memory of 1344 1772 903A.tmp 103 PID 1772 wrote to memory of 1344 1772 903A.tmp 103 PID 1344 wrote to memory of 828 1344 9105.tmp 104 PID 1344 wrote to memory of 828 1344 9105.tmp 104 PID 1344 wrote to memory of 828 1344 9105.tmp 104 PID 828 wrote to memory of 1480 828 9182.tmp 105 PID 828 wrote to memory of 1480 828 9182.tmp 105 PID 828 wrote to memory of 1480 828 9182.tmp 105 PID 1480 wrote to memory of 3080 1480 928B.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef9521f246732faaa96fb3911b850978_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\ef9521f246732faaa96fb3911b850978_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"23⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"24⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"25⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"26⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"27⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"28⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"29⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"30⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"31⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"32⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"33⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"34⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"35⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"36⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"37⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"38⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"39⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"40⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"41⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"42⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"43⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"44⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"45⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"46⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"47⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"48⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"49⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"50⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"51⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"52⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"53⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"54⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"55⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"56⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"57⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"58⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"59⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"60⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"61⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"62⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"63⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"64⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"65⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"66⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"67⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"68⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"69⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"70⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"71⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"72⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"73⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"74⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"75⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"76⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"77⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"78⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"79⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"80⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"81⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"82⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"83⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"84⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"85⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"86⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"87⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"88⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"89⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"90⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"91⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"92⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"93⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"94⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"95⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"96⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"97⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"98⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"99⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"100⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"101⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"102⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"103⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"104⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"105⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"106⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"107⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"108⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"109⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"110⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"111⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"112⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"113⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"114⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"115⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"116⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"117⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"118⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"119⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"120⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"121⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"122⤵PID:3844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-