Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22-01-2024 21:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-22_5ea6e9fcbad570f5c87d84c62d00c2f1_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-22_5ea6e9fcbad570f5c87d84c62d00c2f1_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-01-22_5ea6e9fcbad570f5c87d84c62d00c2f1_mafia.exe
-
Size
488KB
-
MD5
5ea6e9fcbad570f5c87d84c62d00c2f1
-
SHA1
95e0a58be2977a78310dbc637f3aa57dbb0dab45
-
SHA256
203ba8843e450cd7293bf295e99f119140734a41005c1189fbc2153c193592ad
-
SHA512
f760f30d3092e18dda7229a508699a164e7f43515f4e946e02327b566798c52cdf1f1f1315350c99d4cd117351c6cc4d0ebd587968a3531e5fa330e19b840840
-
SSDEEP
12288:/U5rCOTeiD0kIYu5FNTc282bZm5PA4spT86NZ:/UQOJDklH4km5PRspT86N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1692 64A5.tmp 2152 6561.tmp 2452 65EE.tmp 2708 6699.tmp 4664 6765.tmp 4704 67D2.tmp 4636 687E.tmp 2852 6959.tmp 3540 6A24.tmp 3652 6ADF.tmp 2396 6B9B.tmp 5060 6C47.tmp 4752 6CC4.tmp 4348 6D9E.tmp 2308 6E1B.tmp 4036 6FA2.tmp 1348 705D.tmp 2580 7109.tmp 4236 71B5.tmp 5076 7242.tmp 3092 72AF.tmp 852 7417.tmp 2684 74F1.tmp 848 755F.tmp 4604 7649.tmp 1972 7724.tmp 2480 77D0.tmp 3292 786C.tmp 4560 7927.tmp 3760 7A12.tmp 2588 7ADD.tmp 3120 7B89.tmp 3532 7C44.tmp 1036 7CF0.tmp 4200 7D8C.tmp 3648 7E19.tmp 1012 7EC5.tmp 4928 7F52.tmp 2488 7FFD.tmp 1640 808A.tmp 3920 8136.tmp 2824 81D2.tmp 2944 826E.tmp 3440 830B.tmp 908 83A7.tmp 4676 8462.tmp 4624 84EF.tmp 752 857C.tmp 5112 85F9.tmp 552 8695.tmp 4568 8712.tmp 3156 879F.tmp 2300 881C.tmp 756 88A8.tmp 4904 8916.tmp 4504 89A2.tmp 2112 8A2F.tmp 2492 8AAC.tmp 2828 8B38.tmp 2848 8BC5.tmp 1420 8C61.tmp 3508 8CDE.tmp 3088 8D7B.tmp 2612 8DE8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1600 wrote to memory of 1692 1600 2024-01-22_5ea6e9fcbad570f5c87d84c62d00c2f1_mafia.exe 85 PID 1600 wrote to memory of 1692 1600 2024-01-22_5ea6e9fcbad570f5c87d84c62d00c2f1_mafia.exe 85 PID 1600 wrote to memory of 1692 1600 2024-01-22_5ea6e9fcbad570f5c87d84c62d00c2f1_mafia.exe 85 PID 1692 wrote to memory of 2152 1692 64A5.tmp 87 PID 1692 wrote to memory of 2152 1692 64A5.tmp 87 PID 1692 wrote to memory of 2152 1692 64A5.tmp 87 PID 2152 wrote to memory of 2452 2152 6561.tmp 88 PID 2152 wrote to memory of 2452 2152 6561.tmp 88 PID 2152 wrote to memory of 2452 2152 6561.tmp 88 PID 2452 wrote to memory of 2708 2452 65EE.tmp 89 PID 2452 wrote to memory of 2708 2452 65EE.tmp 89 PID 2452 wrote to memory of 2708 2452 65EE.tmp 89 PID 2708 wrote to memory of 4664 2708 6699.tmp 90 PID 2708 wrote to memory of 4664 2708 6699.tmp 90 PID 2708 wrote to memory of 4664 2708 6699.tmp 90 PID 4664 wrote to memory of 4704 4664 6765.tmp 91 PID 4664 wrote to memory of 4704 4664 6765.tmp 91 PID 4664 wrote to memory of 4704 4664 6765.tmp 91 PID 4704 wrote to memory of 4636 4704 67D2.tmp 92 PID 4704 wrote to memory of 4636 4704 67D2.tmp 92 PID 4704 wrote to memory of 4636 4704 67D2.tmp 92 PID 4636 wrote to memory of 2852 4636 687E.tmp 93 PID 4636 wrote to memory of 2852 4636 687E.tmp 93 PID 4636 wrote to memory of 2852 4636 687E.tmp 93 PID 2852 wrote to memory of 3540 2852 6959.tmp 94 PID 2852 wrote to memory of 3540 2852 6959.tmp 94 PID 2852 wrote to memory of 3540 2852 6959.tmp 94 PID 3540 wrote to memory of 3652 3540 6A24.tmp 95 PID 3540 wrote to memory of 3652 3540 6A24.tmp 95 PID 3540 wrote to memory of 3652 3540 6A24.tmp 95 PID 3652 wrote to memory of 2396 3652 6ADF.tmp 96 PID 3652 wrote to memory of 2396 3652 6ADF.tmp 96 PID 3652 wrote to memory of 2396 3652 6ADF.tmp 96 PID 2396 wrote to memory of 5060 2396 6B9B.tmp 97 PID 2396 wrote to memory of 5060 2396 6B9B.tmp 97 PID 2396 wrote to memory of 5060 2396 6B9B.tmp 97 PID 5060 wrote to memory of 4752 5060 6C47.tmp 98 PID 5060 wrote to memory of 4752 5060 6C47.tmp 98 PID 5060 wrote to memory of 4752 5060 6C47.tmp 98 PID 4752 wrote to memory of 4348 4752 6CC4.tmp 99 PID 4752 wrote to memory of 4348 4752 6CC4.tmp 99 PID 4752 wrote to memory of 4348 4752 6CC4.tmp 99 PID 4348 wrote to memory of 2308 4348 6D9E.tmp 100 PID 4348 wrote to memory of 2308 4348 6D9E.tmp 100 PID 4348 wrote to memory of 2308 4348 6D9E.tmp 100 PID 2308 wrote to memory of 4036 2308 6E1B.tmp 101 PID 2308 wrote to memory of 4036 2308 6E1B.tmp 101 PID 2308 wrote to memory of 4036 2308 6E1B.tmp 101 PID 4036 wrote to memory of 1348 4036 6FA2.tmp 102 PID 4036 wrote to memory of 1348 4036 6FA2.tmp 102 PID 4036 wrote to memory of 1348 4036 6FA2.tmp 102 PID 1348 wrote to memory of 2580 1348 705D.tmp 103 PID 1348 wrote to memory of 2580 1348 705D.tmp 103 PID 1348 wrote to memory of 2580 1348 705D.tmp 103 PID 2580 wrote to memory of 4236 2580 7109.tmp 104 PID 2580 wrote to memory of 4236 2580 7109.tmp 104 PID 2580 wrote to memory of 4236 2580 7109.tmp 104 PID 4236 wrote to memory of 5076 4236 71B5.tmp 107 PID 4236 wrote to memory of 5076 4236 71B5.tmp 107 PID 4236 wrote to memory of 5076 4236 71B5.tmp 107 PID 5076 wrote to memory of 3092 5076 7242.tmp 108 PID 5076 wrote to memory of 3092 5076 7242.tmp 108 PID 5076 wrote to memory of 3092 5076 7242.tmp 108 PID 3092 wrote to memory of 852 3092 72AF.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-22_5ea6e9fcbad570f5c87d84c62d00c2f1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-22_5ea6e9fcbad570f5c87d84c62d00c2f1_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"23⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"24⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"25⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"26⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"27⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"28⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"29⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"30⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\7A12.tmp"C:\Users\Admin\AppData\Local\Temp\7A12.tmp"31⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"32⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"33⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"34⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"35⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"36⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"37⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"38⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"39⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"40⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"41⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"42⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"43⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"44⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"45⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"46⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"47⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"48⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"49⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"50⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"51⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"52⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"53⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"54⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"55⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"56⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"57⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"58⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"59⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"60⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"61⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"62⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"63⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"64⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"65⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"66⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"67⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"68⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"69⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"70⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"71⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"72⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"73⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"74⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"75⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"76⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"77⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"78⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"79⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"80⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"81⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"82⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"83⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"84⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"85⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"86⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"87⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"88⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"89⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"90⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"91⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"92⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"93⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"94⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"95⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"96⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"97⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"98⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"99⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"100⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"101⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"102⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"103⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"104⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"105⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"106⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"107⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"108⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"109⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"110⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"111⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"112⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"113⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"114⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"115⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"116⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"117⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"118⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"119⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"120⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"121⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"122⤵PID:624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-