Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2023, 18:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20b9ab2d0e79df73f0e8080adbae4811_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
20b9ab2d0e79df73f0e8080adbae4811_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
20b9ab2d0e79df73f0e8080adbae4811_mafia_JC.exe
-
Size
486KB
-
MD5
20b9ab2d0e79df73f0e8080adbae4811
-
SHA1
fb1f90dcbdf3edf60b79b3f3f51e538ff419aae0
-
SHA256
8d5835cb8013f39862dc5f40092bc527be28b39173a5bcdde3ecb06339ea3300
-
SHA512
fd638ab09fe0966e785633f4dbde6617716dab4a4fc2ce3da9059d475e420baa1f27039a1ce1f3248f0d84a7160543f925fcfe8b1d7077e90869d03298bbf667
-
SSDEEP
12288:/U5rCOTeiD9cPURyFCv3R1u07kBYt/QKeHCj3NZ:/UQOJD9cER3jp7bt4OzN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1748 2621.tmp 2084 2769.tmp 2604 2882.tmp 3060 295D.tmp 3168 2A09.tmp 3900 2AC4.tmp 1736 2BAF.tmp 1168 2C6A.tmp 3604 2D74.tmp 3456 2E20.tmp 2924 2F0A.tmp 1928 3023.tmp 1508 310E.tmp 3732 31B9.tmp 4624 32C3.tmp 3896 336F.tmp 3048 3459.tmp 1260 3505.tmp 380 35D0.tmp 1160 366D.tmp 2992 3738.tmp 2652 3803.tmp 5072 38AF.tmp 836 397A.tmp 3088 3A06.tmp 4392 3AA3.tmp 3744 3B2F.tmp 4640 3BDB.tmp 776 3C87.tmp 4428 3D43.tmp 4872 3DEE.tmp 1280 3F17.tmp 984 3FD3.tmp 1992 4050.tmp 1588 40CD.tmp 5012 414A.tmp 3024 41D6.tmp 3888 4282.tmp 2884 42FF.tmp 2856 43AB.tmp 3012 4476.tmp 1084 4541.tmp 1680 45CE.tmp 4396 468A.tmp 1688 4784.tmp 3232 484F.tmp 4060 48CC.tmp 3560 4958.tmp 2000 49E5.tmp 3932 4A62.tmp 316 4ACF.tmp 2800 4B4C.tmp 3056 4C17.tmp 3944 4C94.tmp 3980 4DCD.tmp 3764 4EE6.tmp 4588 4F54.tmp 3124 4FC1.tmp 5028 505D.tmp 2260 50EA.tmp 4300 5157.tmp 3396 51E4.tmp 3900 5270.tmp 3360 52FD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4568 wrote to memory of 1748 4568 20b9ab2d0e79df73f0e8080adbae4811_mafia_JC.exe 80 PID 4568 wrote to memory of 1748 4568 20b9ab2d0e79df73f0e8080adbae4811_mafia_JC.exe 80 PID 4568 wrote to memory of 1748 4568 20b9ab2d0e79df73f0e8080adbae4811_mafia_JC.exe 80 PID 1748 wrote to memory of 2084 1748 2621.tmp 81 PID 1748 wrote to memory of 2084 1748 2621.tmp 81 PID 1748 wrote to memory of 2084 1748 2621.tmp 81 PID 2084 wrote to memory of 2604 2084 2769.tmp 82 PID 2084 wrote to memory of 2604 2084 2769.tmp 82 PID 2084 wrote to memory of 2604 2084 2769.tmp 82 PID 2604 wrote to memory of 3060 2604 2882.tmp 83 PID 2604 wrote to memory of 3060 2604 2882.tmp 83 PID 2604 wrote to memory of 3060 2604 2882.tmp 83 PID 3060 wrote to memory of 3168 3060 295D.tmp 84 PID 3060 wrote to memory of 3168 3060 295D.tmp 84 PID 3060 wrote to memory of 3168 3060 295D.tmp 84 PID 3168 wrote to memory of 3900 3168 2A09.tmp 85 PID 3168 wrote to memory of 3900 3168 2A09.tmp 85 PID 3168 wrote to memory of 3900 3168 2A09.tmp 85 PID 3900 wrote to memory of 1736 3900 2AC4.tmp 86 PID 3900 wrote to memory of 1736 3900 2AC4.tmp 86 PID 3900 wrote to memory of 1736 3900 2AC4.tmp 86 PID 1736 wrote to memory of 1168 1736 2BAF.tmp 87 PID 1736 wrote to memory of 1168 1736 2BAF.tmp 87 PID 1736 wrote to memory of 1168 1736 2BAF.tmp 87 PID 1168 wrote to memory of 3604 1168 2C6A.tmp 88 PID 1168 wrote to memory of 3604 1168 2C6A.tmp 88 PID 1168 wrote to memory of 3604 1168 2C6A.tmp 88 PID 3604 wrote to memory of 3456 3604 2D74.tmp 89 PID 3604 wrote to memory of 3456 3604 2D74.tmp 89 PID 3604 wrote to memory of 3456 3604 2D74.tmp 89 PID 3456 wrote to memory of 2924 3456 2E20.tmp 90 PID 3456 wrote to memory of 2924 3456 2E20.tmp 90 PID 3456 wrote to memory of 2924 3456 2E20.tmp 90 PID 2924 wrote to memory of 1928 2924 2F0A.tmp 91 PID 2924 wrote to memory of 1928 2924 2F0A.tmp 91 PID 2924 wrote to memory of 1928 2924 2F0A.tmp 91 PID 1928 wrote to memory of 1508 1928 3023.tmp 92 PID 1928 wrote to memory of 1508 1928 3023.tmp 92 PID 1928 wrote to memory of 1508 1928 3023.tmp 92 PID 1508 wrote to memory of 3732 1508 310E.tmp 93 PID 1508 wrote to memory of 3732 1508 310E.tmp 93 PID 1508 wrote to memory of 3732 1508 310E.tmp 93 PID 3732 wrote to memory of 4624 3732 31B9.tmp 94 PID 3732 wrote to memory of 4624 3732 31B9.tmp 94 PID 3732 wrote to memory of 4624 3732 31B9.tmp 94 PID 4624 wrote to memory of 3896 4624 32C3.tmp 95 PID 4624 wrote to memory of 3896 4624 32C3.tmp 95 PID 4624 wrote to memory of 3896 4624 32C3.tmp 95 PID 3896 wrote to memory of 3048 3896 336F.tmp 96 PID 3896 wrote to memory of 3048 3896 336F.tmp 96 PID 3896 wrote to memory of 3048 3896 336F.tmp 96 PID 3048 wrote to memory of 1260 3048 3459.tmp 97 PID 3048 wrote to memory of 1260 3048 3459.tmp 97 PID 3048 wrote to memory of 1260 3048 3459.tmp 97 PID 1260 wrote to memory of 380 1260 3505.tmp 98 PID 1260 wrote to memory of 380 1260 3505.tmp 98 PID 1260 wrote to memory of 380 1260 3505.tmp 98 PID 380 wrote to memory of 1160 380 35D0.tmp 99 PID 380 wrote to memory of 1160 380 35D0.tmp 99 PID 380 wrote to memory of 1160 380 35D0.tmp 99 PID 1160 wrote to memory of 2992 1160 366D.tmp 100 PID 1160 wrote to memory of 2992 1160 366D.tmp 100 PID 1160 wrote to memory of 2992 1160 366D.tmp 100 PID 2992 wrote to memory of 2652 2992 3738.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\20b9ab2d0e79df73f0e8080adbae4811_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\20b9ab2d0e79df73f0e8080adbae4811_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\2769.tmp"C:\Users\Admin\AppData\Local\Temp\2769.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\2882.tmp"C:\Users\Admin\AppData\Local\Temp\2882.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\2A09.tmp"C:\Users\Admin\AppData\Local\Temp\2A09.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\2D74.tmp"C:\Users\Admin\AppData\Local\Temp\2D74.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\2E20.tmp"C:\Users\Admin\AppData\Local\Temp\2E20.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\310E.tmp"C:\Users\Admin\AppData\Local\Temp\310E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\3803.tmp"C:\Users\Admin\AppData\Local\Temp\3803.tmp"23⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\38AF.tmp"C:\Users\Admin\AppData\Local\Temp\38AF.tmp"24⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"25⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\3A06.tmp"C:\Users\Admin\AppData\Local\Temp\3A06.tmp"26⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"27⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"28⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"29⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"30⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\3D43.tmp"C:\Users\Admin\AppData\Local\Temp\3D43.tmp"31⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"32⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\3F17.tmp"C:\Users\Admin\AppData\Local\Temp\3F17.tmp"33⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"34⤵
- Executes dropped EXE
PID:984 -
C:\Users\Admin\AppData\Local\Temp\4050.tmp"C:\Users\Admin\AppData\Local\Temp\4050.tmp"35⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\40CD.tmp"C:\Users\Admin\AppData\Local\Temp\40CD.tmp"36⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\414A.tmp"C:\Users\Admin\AppData\Local\Temp\414A.tmp"37⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\41D6.tmp"C:\Users\Admin\AppData\Local\Temp\41D6.tmp"38⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\4282.tmp"C:\Users\Admin\AppData\Local\Temp\4282.tmp"39⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\42FF.tmp"C:\Users\Admin\AppData\Local\Temp\42FF.tmp"40⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\43AB.tmp"C:\Users\Admin\AppData\Local\Temp\43AB.tmp"41⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\4476.tmp"C:\Users\Admin\AppData\Local\Temp\4476.tmp"42⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\4541.tmp"C:\Users\Admin\AppData\Local\Temp\4541.tmp"43⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\45CE.tmp"C:\Users\Admin\AppData\Local\Temp\45CE.tmp"44⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\468A.tmp"C:\Users\Admin\AppData\Local\Temp\468A.tmp"45⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"46⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\484F.tmp"C:\Users\Admin\AppData\Local\Temp\484F.tmp"47⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\48CC.tmp"C:\Users\Admin\AppData\Local\Temp\48CC.tmp"48⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\4958.tmp"C:\Users\Admin\AppData\Local\Temp\4958.tmp"49⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\49E5.tmp"C:\Users\Admin\AppData\Local\Temp\49E5.tmp"50⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\4A62.tmp"C:\Users\Admin\AppData\Local\Temp\4A62.tmp"51⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"52⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"53⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\4C17.tmp"C:\Users\Admin\AppData\Local\Temp\4C17.tmp"54⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\4C94.tmp"C:\Users\Admin\AppData\Local\Temp\4C94.tmp"55⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\4D21.tmp"C:\Users\Admin\AppData\Local\Temp\4D21.tmp"56⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\4DCD.tmp"C:\Users\Admin\AppData\Local\Temp\4DCD.tmp"57⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"58⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\4F54.tmp"C:\Users\Admin\AppData\Local\Temp\4F54.tmp"59⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"60⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\505D.tmp"C:\Users\Admin\AppData\Local\Temp\505D.tmp"61⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\50EA.tmp"C:\Users\Admin\AppData\Local\Temp\50EA.tmp"62⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\5157.tmp"C:\Users\Admin\AppData\Local\Temp\5157.tmp"63⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\51E4.tmp"C:\Users\Admin\AppData\Local\Temp\51E4.tmp"64⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\5270.tmp"C:\Users\Admin\AppData\Local\Temp\5270.tmp"65⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\52FD.tmp"C:\Users\Admin\AppData\Local\Temp\52FD.tmp"66⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\5399.tmp"C:\Users\Admin\AppData\Local\Temp\5399.tmp"67⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\5426.tmp"C:\Users\Admin\AppData\Local\Temp\5426.tmp"68⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"69⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\5530.tmp"C:\Users\Admin\AppData\Local\Temp\5530.tmp"70⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\55BC.tmp"C:\Users\Admin\AppData\Local\Temp\55BC.tmp"71⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\562A.tmp"C:\Users\Admin\AppData\Local\Temp\562A.tmp"72⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\56B6.tmp"C:\Users\Admin\AppData\Local\Temp\56B6.tmp"73⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\5733.tmp"C:\Users\Admin\AppData\Local\Temp\5733.tmp"74⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\57C0.tmp"C:\Users\Admin\AppData\Local\Temp\57C0.tmp"75⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\582D.tmp"C:\Users\Admin\AppData\Local\Temp\582D.tmp"76⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"77⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"78⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\59D3.tmp"C:\Users\Admin\AppData\Local\Temp\59D3.tmp"79⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"80⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"81⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"82⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"83⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\5C44.tmp"C:\Users\Admin\AppData\Local\Temp\5C44.tmp"84⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"85⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"86⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"87⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\5E38.tmp"C:\Users\Admin\AppData\Local\Temp\5E38.tmp"88⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\5ED4.tmp"C:\Users\Admin\AppData\Local\Temp\5ED4.tmp"89⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\5F42.tmp"C:\Users\Admin\AppData\Local\Temp\5F42.tmp"90⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\5FAF.tmp"C:\Users\Admin\AppData\Local\Temp\5FAF.tmp"91⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\603C.tmp"C:\Users\Admin\AppData\Local\Temp\603C.tmp"92⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\60B9.tmp"C:\Users\Admin\AppData\Local\Temp\60B9.tmp"93⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\6145.tmp"C:\Users\Admin\AppData\Local\Temp\6145.tmp"94⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\61C2.tmp"C:\Users\Admin\AppData\Local\Temp\61C2.tmp"95⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\624F.tmp"C:\Users\Admin\AppData\Local\Temp\624F.tmp"96⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\62FB.tmp"C:\Users\Admin\AppData\Local\Temp\62FB.tmp"97⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"98⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\6404.tmp"C:\Users\Admin\AppData\Local\Temp\6404.tmp"99⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\64C0.tmp"C:\Users\Admin\AppData\Local\Temp\64C0.tmp"100⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\653D.tmp"C:\Users\Admin\AppData\Local\Temp\653D.tmp"101⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\65BA.tmp"C:\Users\Admin\AppData\Local\Temp\65BA.tmp"102⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\6637.tmp"C:\Users\Admin\AppData\Local\Temp\6637.tmp"103⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\66A4.tmp"C:\Users\Admin\AppData\Local\Temp\66A4.tmp"104⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\6731.tmp"C:\Users\Admin\AppData\Local\Temp\6731.tmp"105⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\67AE.tmp"C:\Users\Admin\AppData\Local\Temp\67AE.tmp"106⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\683B.tmp"C:\Users\Admin\AppData\Local\Temp\683B.tmp"107⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\68A8.tmp"C:\Users\Admin\AppData\Local\Temp\68A8.tmp"108⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\6925.tmp"C:\Users\Admin\AppData\Local\Temp\6925.tmp"109⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\69A2.tmp"C:\Users\Admin\AppData\Local\Temp\69A2.tmp"110⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"111⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"112⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\6B57.tmp"C:\Users\Admin\AppData\Local\Temp\6B57.tmp"113⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"114⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\6C61.tmp"C:\Users\Admin\AppData\Local\Temp\6C61.tmp"115⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"116⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"117⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\6E07.tmp"C:\Users\Admin\AppData\Local\Temp\6E07.tmp"118⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\6E94.tmp"C:\Users\Admin\AppData\Local\Temp\6E94.tmp"119⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\6F20.tmp"C:\Users\Admin\AppData\Local\Temp\6F20.tmp"120⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"121⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\7049.tmp"C:\Users\Admin\AppData\Local\Temp\7049.tmp"122⤵PID:1132
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-