Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17-08-2023 18:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20585f75062ebac61414f17809f6987a_mafia_JC.exe
Resource
win7-20230712-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
20585f75062ebac61414f17809f6987a_mafia_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
20585f75062ebac61414f17809f6987a_mafia_JC.exe
-
Size
486KB
-
MD5
20585f75062ebac61414f17809f6987a
-
SHA1
15cae69ad194e9c1b48d3780da62f1a979595929
-
SHA256
7cde75e59b20f1071192a5cc4b3e6b59d4569e0b42fa18d4da2d77b6572f7143
-
SHA512
eca51ac9335518096926a2204e9c58fa8fe134bda77a28b4fd3bb0766c39ffe5a358461b35b23c23000547bb4d8ce1a87a8928a33f94ccdef4339848b6f81720
-
SSDEEP
12288:/U5rCOTeiDOZX3GvrpBVbeZf8FIyF0VF2KNZ:/UQOJDOZnGvrpY0FIy2tN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1320 7E29.tmp 1364 7ED5.tmp 1572 7F80.tmp 1984 802C.tmp 3404 8136.tmp 2880 81C3.tmp 3656 825F.tmp 2156 8397.tmp 1836 8443.tmp 60 84EF.tmp 1788 85BA.tmp 5036 8647.tmp 388 8712.tmp 3360 881C.tmp 4880 88A8.tmp 548 8983.tmp 4888 8A1F.tmp 3748 8ADB.tmp 4344 8B87.tmp 3860 8CCF.tmp 2888 8D7B.tmp 3848 8E26.tmp 4484 8EB3.tmp 2452 8F40.tmp 2508 8FDC.tmp 1468 9088.tmp 4340 9105.tmp 3340 91EF.tmp 4408 92DA.tmp 4392 9366.tmp 1372 9441.tmp 4768 94DD.tmp 3488 956A.tmp 4656 95F6.tmp 4740 9673.tmp 4440 9710.tmp 1060 978D.tmp 2548 9829.tmp 1792 98C5.tmp 4072 9952.tmp 3588 99CF.tmp 2852 9A7B.tmp 2020 9B07.tmp 3752 9B94.tmp 3636 9C40.tmp 2068 9CEC.tmp 2796 9D98.tmp 3804 9E15.tmp 4180 9EA1.tmp 1056 9F2E.tmp 1548 9FBA.tmp 4144 A047.tmp 1984 A0E3.tmp 2692 A19F.tmp 5080 A23B.tmp 4320 A2C8.tmp 3656 A364.tmp 4396 A3F1.tmp 1616 A47D.tmp 2340 A50A.tmp 4504 A5B6.tmp 1036 A671.tmp 4920 A6EE.tmp 3216 A75C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3804 wrote to memory of 1320 3804 20585f75062ebac61414f17809f6987a_mafia_JC.exe 82 PID 3804 wrote to memory of 1320 3804 20585f75062ebac61414f17809f6987a_mafia_JC.exe 82 PID 3804 wrote to memory of 1320 3804 20585f75062ebac61414f17809f6987a_mafia_JC.exe 82 PID 1320 wrote to memory of 1364 1320 7E29.tmp 83 PID 1320 wrote to memory of 1364 1320 7E29.tmp 83 PID 1320 wrote to memory of 1364 1320 7E29.tmp 83 PID 1364 wrote to memory of 1572 1364 7ED5.tmp 84 PID 1364 wrote to memory of 1572 1364 7ED5.tmp 84 PID 1364 wrote to memory of 1572 1364 7ED5.tmp 84 PID 1572 wrote to memory of 1984 1572 7F80.tmp 85 PID 1572 wrote to memory of 1984 1572 7F80.tmp 85 PID 1572 wrote to memory of 1984 1572 7F80.tmp 85 PID 1984 wrote to memory of 3404 1984 802C.tmp 86 PID 1984 wrote to memory of 3404 1984 802C.tmp 86 PID 1984 wrote to memory of 3404 1984 802C.tmp 86 PID 3404 wrote to memory of 2880 3404 8136.tmp 87 PID 3404 wrote to memory of 2880 3404 8136.tmp 87 PID 3404 wrote to memory of 2880 3404 8136.tmp 87 PID 2880 wrote to memory of 3656 2880 81C3.tmp 88 PID 2880 wrote to memory of 3656 2880 81C3.tmp 88 PID 2880 wrote to memory of 3656 2880 81C3.tmp 88 PID 3656 wrote to memory of 2156 3656 825F.tmp 89 PID 3656 wrote to memory of 2156 3656 825F.tmp 89 PID 3656 wrote to memory of 2156 3656 825F.tmp 89 PID 2156 wrote to memory of 1836 2156 8397.tmp 90 PID 2156 wrote to memory of 1836 2156 8397.tmp 90 PID 2156 wrote to memory of 1836 2156 8397.tmp 90 PID 1836 wrote to memory of 60 1836 8443.tmp 91 PID 1836 wrote to memory of 60 1836 8443.tmp 91 PID 1836 wrote to memory of 60 1836 8443.tmp 91 PID 60 wrote to memory of 1788 60 84EF.tmp 92 PID 60 wrote to memory of 1788 60 84EF.tmp 92 PID 60 wrote to memory of 1788 60 84EF.tmp 92 PID 1788 wrote to memory of 5036 1788 85BA.tmp 93 PID 1788 wrote to memory of 5036 1788 85BA.tmp 93 PID 1788 wrote to memory of 5036 1788 85BA.tmp 93 PID 5036 wrote to memory of 388 5036 8647.tmp 94 PID 5036 wrote to memory of 388 5036 8647.tmp 94 PID 5036 wrote to memory of 388 5036 8647.tmp 94 PID 388 wrote to memory of 3360 388 8712.tmp 95 PID 388 wrote to memory of 3360 388 8712.tmp 95 PID 388 wrote to memory of 3360 388 8712.tmp 95 PID 3360 wrote to memory of 4880 3360 881C.tmp 96 PID 3360 wrote to memory of 4880 3360 881C.tmp 96 PID 3360 wrote to memory of 4880 3360 881C.tmp 96 PID 4880 wrote to memory of 548 4880 88A8.tmp 97 PID 4880 wrote to memory of 548 4880 88A8.tmp 97 PID 4880 wrote to memory of 548 4880 88A8.tmp 97 PID 548 wrote to memory of 4888 548 8983.tmp 100 PID 548 wrote to memory of 4888 548 8983.tmp 100 PID 548 wrote to memory of 4888 548 8983.tmp 100 PID 4888 wrote to memory of 3748 4888 8A1F.tmp 101 PID 4888 wrote to memory of 3748 4888 8A1F.tmp 101 PID 4888 wrote to memory of 3748 4888 8A1F.tmp 101 PID 3748 wrote to memory of 4344 3748 8ADB.tmp 102 PID 3748 wrote to memory of 4344 3748 8ADB.tmp 102 PID 3748 wrote to memory of 4344 3748 8ADB.tmp 102 PID 4344 wrote to memory of 3860 4344 8B87.tmp 103 PID 4344 wrote to memory of 3860 4344 8B87.tmp 103 PID 4344 wrote to memory of 3860 4344 8B87.tmp 103 PID 3860 wrote to memory of 2888 3860 8CCF.tmp 104 PID 3860 wrote to memory of 2888 3860 8CCF.tmp 104 PID 3860 wrote to memory of 2888 3860 8CCF.tmp 104 PID 2888 wrote to memory of 3848 2888 8D7B.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\20585f75062ebac61414f17809f6987a_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\20585f75062ebac61414f17809f6987a_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"23⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"24⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"25⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"26⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"27⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"28⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"29⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"30⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"31⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"32⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"33⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"34⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"35⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"36⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"37⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"38⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"39⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"40⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"41⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"42⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"43⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"44⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"45⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"46⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"47⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"48⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"49⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"50⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"51⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"52⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"53⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"54⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"55⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"56⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"57⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"58⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"59⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"60⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"61⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"62⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"63⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"64⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"65⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"66⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"67⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"68⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"69⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"70⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"71⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"72⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"73⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"74⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"75⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"76⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"77⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"78⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"79⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"80⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"81⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"82⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"83⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"84⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"85⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"86⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"87⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"88⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"89⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"90⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"91⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"92⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"93⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"94⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"95⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"96⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"97⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"98⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"99⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"100⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"101⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"102⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"103⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"104⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"105⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"106⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"107⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"108⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"109⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"110⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"111⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"112⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"113⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"114⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"115⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"116⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"117⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"118⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"119⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"120⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"121⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"122⤵PID:1708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-