Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 16:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f62e8eabb88e68acd33fd0bee05b7906_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f62e8eabb88e68acd33fd0bee05b7906_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
f62e8eabb88e68acd33fd0bee05b7906_mafia_JC.exe
-
Size
520KB
-
MD5
f62e8eabb88e68acd33fd0bee05b7906
-
SHA1
e854fb36ef3000d97f958890277bae39541d3fe0
-
SHA256
9c72e6702c481363ae42437d5f6ac216564aa5a7cfff10f7f6a093d423f21716
-
SHA512
86711f5982f9a9e23e33c893f9482457cc104bc19c864c70f8866dbbe598469d8dd3b3d3cb189acb0425180966d930fbff1d7c4093bb4411f7bf36db8f127b00
-
SSDEEP
12288:roRXOQjmOysZzPqqX1UOJIScWRUQUVUPRiUlNZ:rogQ9ysFy/OJtRUTVUPRiaN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4756 7C44.tmp 4924 7CF0.tmp 4604 7D8C.tmp 5064 7E86.tmp 1204 7F52.tmp 3948 7FCF.tmp 4176 80A9.tmp 3396 8155.tmp 4528 8230.tmp 4136 82AD.tmp 3604 832A.tmp 2668 83B7.tmp 1996 8491.tmp 2704 855C.tmp 3876 8618.tmp 2724 8770.tmp 1532 8879.tmp 2028 8935.tmp 4892 8A1F.tmp 3280 8ABB.tmp 1244 8BA6.tmp 4248 8C52.tmp 4780 8CEE.tmp 3032 8D6B.tmp 2380 8E36.tmp 2444 8F11.tmp 1328 8FAD.tmp 4796 9049.tmp 4000 9124.tmp 4208 91D0.tmp 3860 927C.tmp 3144 9328.tmp 4240 93E3.tmp 412 9470.tmp 1824 94FC.tmp 4416 9579.tmp 3640 95F6.tmp 684 9693.tmp 3720 9710.tmp 4664 97AC.tmp 3304 9829.tmp 1580 98B6.tmp 4820 9942.tmp 772 99CF.tmp 3628 9A4C.tmp 1260 9AB9.tmp 2340 9B36.tmp 3336 9BB3.tmp 3752 9C40.tmp 2624 9CBD.tmp 3928 9D3A.tmp 2152 9DC6.tmp 400 9E34.tmp 4244 9EEF.tmp 2792 9F8C.tmp 4724 A009.tmp 224 A076.tmp 2428 A0E3.tmp 948 A170.tmp 3840 A1DD.tmp 4784 A24B.tmp 4460 A2E7.tmp 1252 A383.tmp 1964 A41F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2064 wrote to memory of 4756 2064 f62e8eabb88e68acd33fd0bee05b7906_mafia_JC.exe 80 PID 2064 wrote to memory of 4756 2064 f62e8eabb88e68acd33fd0bee05b7906_mafia_JC.exe 80 PID 2064 wrote to memory of 4756 2064 f62e8eabb88e68acd33fd0bee05b7906_mafia_JC.exe 80 PID 4756 wrote to memory of 4924 4756 7C44.tmp 81 PID 4756 wrote to memory of 4924 4756 7C44.tmp 81 PID 4756 wrote to memory of 4924 4756 7C44.tmp 81 PID 4924 wrote to memory of 4604 4924 7CF0.tmp 82 PID 4924 wrote to memory of 4604 4924 7CF0.tmp 82 PID 4924 wrote to memory of 4604 4924 7CF0.tmp 82 PID 4604 wrote to memory of 5064 4604 7D8C.tmp 83 PID 4604 wrote to memory of 5064 4604 7D8C.tmp 83 PID 4604 wrote to memory of 5064 4604 7D8C.tmp 83 PID 5064 wrote to memory of 1204 5064 7E86.tmp 84 PID 5064 wrote to memory of 1204 5064 7E86.tmp 84 PID 5064 wrote to memory of 1204 5064 7E86.tmp 84 PID 1204 wrote to memory of 3948 1204 7F52.tmp 85 PID 1204 wrote to memory of 3948 1204 7F52.tmp 85 PID 1204 wrote to memory of 3948 1204 7F52.tmp 85 PID 3948 wrote to memory of 4176 3948 7FCF.tmp 86 PID 3948 wrote to memory of 4176 3948 7FCF.tmp 86 PID 3948 wrote to memory of 4176 3948 7FCF.tmp 86 PID 4176 wrote to memory of 3396 4176 80A9.tmp 87 PID 4176 wrote to memory of 3396 4176 80A9.tmp 87 PID 4176 wrote to memory of 3396 4176 80A9.tmp 87 PID 3396 wrote to memory of 4528 3396 8155.tmp 88 PID 3396 wrote to memory of 4528 3396 8155.tmp 88 PID 3396 wrote to memory of 4528 3396 8155.tmp 88 PID 4528 wrote to memory of 4136 4528 8230.tmp 90 PID 4528 wrote to memory of 4136 4528 8230.tmp 90 PID 4528 wrote to memory of 4136 4528 8230.tmp 90 PID 4136 wrote to memory of 3604 4136 82AD.tmp 91 PID 4136 wrote to memory of 3604 4136 82AD.tmp 91 PID 4136 wrote to memory of 3604 4136 82AD.tmp 91 PID 3604 wrote to memory of 2668 3604 832A.tmp 92 PID 3604 wrote to memory of 2668 3604 832A.tmp 92 PID 3604 wrote to memory of 2668 3604 832A.tmp 92 PID 2668 wrote to memory of 1996 2668 83B7.tmp 93 PID 2668 wrote to memory of 1996 2668 83B7.tmp 93 PID 2668 wrote to memory of 1996 2668 83B7.tmp 93 PID 1996 wrote to memory of 2704 1996 8491.tmp 94 PID 1996 wrote to memory of 2704 1996 8491.tmp 94 PID 1996 wrote to memory of 2704 1996 8491.tmp 94 PID 2704 wrote to memory of 3876 2704 855C.tmp 95 PID 2704 wrote to memory of 3876 2704 855C.tmp 95 PID 2704 wrote to memory of 3876 2704 855C.tmp 95 PID 3876 wrote to memory of 2724 3876 8618.tmp 96 PID 3876 wrote to memory of 2724 3876 8618.tmp 96 PID 3876 wrote to memory of 2724 3876 8618.tmp 96 PID 2724 wrote to memory of 1532 2724 8770.tmp 97 PID 2724 wrote to memory of 1532 2724 8770.tmp 97 PID 2724 wrote to memory of 1532 2724 8770.tmp 97 PID 1532 wrote to memory of 2028 1532 8879.tmp 98 PID 1532 wrote to memory of 2028 1532 8879.tmp 98 PID 1532 wrote to memory of 2028 1532 8879.tmp 98 PID 2028 wrote to memory of 4892 2028 8935.tmp 99 PID 2028 wrote to memory of 4892 2028 8935.tmp 99 PID 2028 wrote to memory of 4892 2028 8935.tmp 99 PID 4892 wrote to memory of 3280 4892 8A1F.tmp 100 PID 4892 wrote to memory of 3280 4892 8A1F.tmp 100 PID 4892 wrote to memory of 3280 4892 8A1F.tmp 100 PID 3280 wrote to memory of 1244 3280 8ABB.tmp 101 PID 3280 wrote to memory of 1244 3280 8ABB.tmp 101 PID 3280 wrote to memory of 1244 3280 8ABB.tmp 101 PID 1244 wrote to memory of 4248 1244 8BA6.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\f62e8eabb88e68acd33fd0bee05b7906_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\f62e8eabb88e68acd33fd0bee05b7906_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"23⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"24⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"25⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"26⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"27⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"28⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"29⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"30⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"31⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"32⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"33⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"34⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"35⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"36⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"37⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"38⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"39⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"40⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"41⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"42⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"43⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"44⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"45⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"46⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"47⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"48⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"49⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"50⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"51⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"52⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"53⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"54⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"55⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"56⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"57⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"58⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"59⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"60⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"61⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"62⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"63⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"64⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"65⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"66⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"67⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"68⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"69⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"70⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"71⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"72⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"73⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"74⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"75⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"76⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"77⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"78⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"79⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"80⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"81⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"82⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"83⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"84⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"85⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"86⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"87⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"88⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"89⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"90⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"91⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"92⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"93⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"94⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"95⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"96⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"97⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\B585.tmp"C:\Users\Admin\AppData\Local\Temp\B585.tmp"98⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"99⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"100⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"101⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"102⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"103⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"104⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"105⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"106⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"107⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"108⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"109⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"110⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"111⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"112⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"113⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"114⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"115⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"116⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"117⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"118⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"119⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"120⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"121⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"122⤵PID:4196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-