Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 13:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-25_d3f8783a0d91ae7a6819f8d5ed54000a_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-25_d3f8783a0d91ae7a6819f8d5ed54000a_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-01-25_d3f8783a0d91ae7a6819f8d5ed54000a_mafia.exe
-
Size
541KB
-
MD5
d3f8783a0d91ae7a6819f8d5ed54000a
-
SHA1
93ea6ad64e4082c97044d2032de28dac80fa827f
-
SHA256
706772c9242ad7259157e55bf9c51a81c0f99444e307dcd83c02b709dcf55a38
-
SHA512
800564fd55301017af07d6f744f245f77cc9e9307f13a67b7a8f5eee8a6fc593954bec0d9ef177c0d7a9297599ae0f41de846caf2afc6aa0f55ba7f5f6b70d4c
-
SSDEEP
12288:UU5rCOTeif5siglTHJmVzh7iVLKfFhlQ8TNdfrZa73ctO:UUQOJfXgZHKhkLKfXllhNrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4860 C832.tmp 3800 C999.tmp 2084 CA55.tmp 2072 CB5E.tmp 2404 CC39.tmp 2212 CD23.tmp 3320 CDDF.tmp 3864 CEAA.tmp 3840 CFC3.tmp 4940 D06F.tmp 4776 D13A.tmp 5096 D1B7.tmp 3904 D2A2.tmp 3216 D3BB.tmp 5084 D476.tmp 3068 D542.tmp 3520 D5DE.tmp 3276 D6B9.tmp 3344 D774.tmp 3364 D810.tmp 4136 D8BC.tmp 4912 D968.tmp 536 D9F5.tmp 908 DACF.tmp 4840 DB8B.tmp 944 DC37.tmp 4516 DCD3.tmp 1628 DD9E.tmp 1940 DE69.tmp 3568 DF25.tmp 1724 DFC1.tmp 3280 E07D.tmp 2060 E138.tmp 4052 E1C5.tmp 3692 E232.tmp 2264 E2BF.tmp 4560 E33C.tmp 4108 E3A9.tmp 2464 E445.tmp 1336 E4D2.tmp 1656 E57E.tmp 3272 E687.tmp 1916 E733.tmp 1328 E7C0.tmp 1456 E84D.tmp 1492 E8AA.tmp 3360 E927.tmp 4472 EA21.tmp 4172 EA8F.tmp 1484 EAFC.tmp 2772 EB69.tmp 4068 EBD7.tmp 4856 EC44.tmp 3760 ECF0.tmp 1428 ED5D.tmp 1772 EDCB.tmp 3968 EE38.tmp 4260 EEA6.tmp 4880 EF32.tmp 488 EFCE.tmp 1688 F03C.tmp 1956 F1E2.tmp 3204 F24F.tmp 1648 F2BC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 4860 2596 2024-01-25_d3f8783a0d91ae7a6819f8d5ed54000a_mafia.exe 88 PID 2596 wrote to memory of 4860 2596 2024-01-25_d3f8783a0d91ae7a6819f8d5ed54000a_mafia.exe 88 PID 2596 wrote to memory of 4860 2596 2024-01-25_d3f8783a0d91ae7a6819f8d5ed54000a_mafia.exe 88 PID 4860 wrote to memory of 3800 4860 C832.tmp 89 PID 4860 wrote to memory of 3800 4860 C832.tmp 89 PID 4860 wrote to memory of 3800 4860 C832.tmp 89 PID 3800 wrote to memory of 2084 3800 C999.tmp 90 PID 3800 wrote to memory of 2084 3800 C999.tmp 90 PID 3800 wrote to memory of 2084 3800 C999.tmp 90 PID 2084 wrote to memory of 2072 2084 CA55.tmp 91 PID 2084 wrote to memory of 2072 2084 CA55.tmp 91 PID 2084 wrote to memory of 2072 2084 CA55.tmp 91 PID 2072 wrote to memory of 2404 2072 CB5E.tmp 92 PID 2072 wrote to memory of 2404 2072 CB5E.tmp 92 PID 2072 wrote to memory of 2404 2072 CB5E.tmp 92 PID 2404 wrote to memory of 2212 2404 CC39.tmp 93 PID 2404 wrote to memory of 2212 2404 CC39.tmp 93 PID 2404 wrote to memory of 2212 2404 CC39.tmp 93 PID 2212 wrote to memory of 3320 2212 CD23.tmp 94 PID 2212 wrote to memory of 3320 2212 CD23.tmp 94 PID 2212 wrote to memory of 3320 2212 CD23.tmp 94 PID 3320 wrote to memory of 3864 3320 CDDF.tmp 95 PID 3320 wrote to memory of 3864 3320 CDDF.tmp 95 PID 3320 wrote to memory of 3864 3320 CDDF.tmp 95 PID 3864 wrote to memory of 3840 3864 CEAA.tmp 96 PID 3864 wrote to memory of 3840 3864 CEAA.tmp 96 PID 3864 wrote to memory of 3840 3864 CEAA.tmp 96 PID 3840 wrote to memory of 4940 3840 CFC3.tmp 97 PID 3840 wrote to memory of 4940 3840 CFC3.tmp 97 PID 3840 wrote to memory of 4940 3840 CFC3.tmp 97 PID 4940 wrote to memory of 4776 4940 D06F.tmp 98 PID 4940 wrote to memory of 4776 4940 D06F.tmp 98 PID 4940 wrote to memory of 4776 4940 D06F.tmp 98 PID 4776 wrote to memory of 5096 4776 D13A.tmp 99 PID 4776 wrote to memory of 5096 4776 D13A.tmp 99 PID 4776 wrote to memory of 5096 4776 D13A.tmp 99 PID 5096 wrote to memory of 3904 5096 D1B7.tmp 100 PID 5096 wrote to memory of 3904 5096 D1B7.tmp 100 PID 5096 wrote to memory of 3904 5096 D1B7.tmp 100 PID 3904 wrote to memory of 3216 3904 D2A2.tmp 101 PID 3904 wrote to memory of 3216 3904 D2A2.tmp 101 PID 3904 wrote to memory of 3216 3904 D2A2.tmp 101 PID 3216 wrote to memory of 5084 3216 D3BB.tmp 102 PID 3216 wrote to memory of 5084 3216 D3BB.tmp 102 PID 3216 wrote to memory of 5084 3216 D3BB.tmp 102 PID 5084 wrote to memory of 3068 5084 D476.tmp 103 PID 5084 wrote to memory of 3068 5084 D476.tmp 103 PID 5084 wrote to memory of 3068 5084 D476.tmp 103 PID 3068 wrote to memory of 3520 3068 D542.tmp 104 PID 3068 wrote to memory of 3520 3068 D542.tmp 104 PID 3068 wrote to memory of 3520 3068 D542.tmp 104 PID 3520 wrote to memory of 3276 3520 D5DE.tmp 105 PID 3520 wrote to memory of 3276 3520 D5DE.tmp 105 PID 3520 wrote to memory of 3276 3520 D5DE.tmp 105 PID 3276 wrote to memory of 3344 3276 D6B9.tmp 106 PID 3276 wrote to memory of 3344 3276 D6B9.tmp 106 PID 3276 wrote to memory of 3344 3276 D6B9.tmp 106 PID 3344 wrote to memory of 3364 3344 D774.tmp 107 PID 3344 wrote to memory of 3364 3344 D774.tmp 107 PID 3344 wrote to memory of 3364 3344 D774.tmp 107 PID 3364 wrote to memory of 4136 3364 D810.tmp 108 PID 3364 wrote to memory of 4136 3364 D810.tmp 108 PID 3364 wrote to memory of 4136 3364 D810.tmp 108 PID 4136 wrote to memory of 4912 4136 D8BC.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_d3f8783a0d91ae7a6819f8d5ed54000a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_d3f8783a0d91ae7a6819f8d5ed54000a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\CC39.tmp"C:\Users\Admin\AppData\Local\Temp\CC39.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\CD23.tmp"C:\Users\Admin\AppData\Local\Temp\CD23.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\D06F.tmp"C:\Users\Admin\AppData\Local\Temp\D06F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\D476.tmp"C:\Users\Admin\AppData\Local\Temp\D476.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\D774.tmp"C:\Users\Admin\AppData\Local\Temp\D774.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"23⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"24⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"25⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"26⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\DC37.tmp"C:\Users\Admin\AppData\Local\Temp\DC37.tmp"27⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"28⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"29⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\DE69.tmp"C:\Users\Admin\AppData\Local\Temp\DE69.tmp"30⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\DF25.tmp"C:\Users\Admin\AppData\Local\Temp\DF25.tmp"31⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"32⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\E07D.tmp"C:\Users\Admin\AppData\Local\Temp\E07D.tmp"33⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\E138.tmp"C:\Users\Admin\AppData\Local\Temp\E138.tmp"34⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"35⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"36⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"37⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\E33C.tmp"C:\Users\Admin\AppData\Local\Temp\E33C.tmp"38⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"39⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\E445.tmp"C:\Users\Admin\AppData\Local\Temp\E445.tmp"40⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"41⤵
- Executes dropped EXE
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"42⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"43⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\E687.tmp"C:\Users\Admin\AppData\Local\Temp\E687.tmp"44⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"45⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"46⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"47⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"48⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"49⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"50⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"51⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"52⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"53⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"54⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"55⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"56⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"57⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"58⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\EE38.tmp"C:\Users\Admin\AppData\Local\Temp\EE38.tmp"59⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"60⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"61⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"62⤵
- Executes dropped EXE
PID:488 -
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"63⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"64⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\F24F.tmp"C:\Users\Admin\AppData\Local\Temp\F24F.tmp"65⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"66⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\F349.tmp"C:\Users\Admin\AppData\Local\Temp\F349.tmp"67⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"68⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\F462.tmp"C:\Users\Admin\AppData\Local\Temp\F462.tmp"69⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"70⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\F56C.tmp"C:\Users\Admin\AppData\Local\Temp\F56C.tmp"71⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"72⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\F666.tmp"C:\Users\Admin\AppData\Local\Temp\F666.tmp"73⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"74⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"75⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"76⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\F85A.tmp"C:\Users\Admin\AppData\Local\Temp\F85A.tmp"77⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"78⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\F935.tmp"C:\Users\Admin\AppData\Local\Temp\F935.tmp"79⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"80⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"81⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"82⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\FB19.tmp"C:\Users\Admin\AppData\Local\Temp\FB19.tmp"83⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"84⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\FBE4.tmp"C:\Users\Admin\AppData\Local\Temp\FBE4.tmp"85⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\FC61.tmp"C:\Users\Admin\AppData\Local\Temp\FC61.tmp"86⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"87⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"88⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"89⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\FE65.tmp"C:\Users\Admin\AppData\Local\Temp\FE65.tmp"90⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"91⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"92⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"93⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"94⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"95⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\124.tmp"C:\Users\Admin\AppData\Local\Temp\124.tmp"96⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"97⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"98⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"99⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\308.tmp"C:\Users\Admin\AppData\Local\Temp\308.tmp"100⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"101⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\3D3.tmp"C:\Users\Admin\AppData\Local\Temp\3D3.tmp"102⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"103⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"104⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"105⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"106⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\6C1.tmp"C:\Users\Admin\AppData\Local\Temp\6C1.tmp"107⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\72F.tmp"C:\Users\Admin\AppData\Local\Temp\72F.tmp"108⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"109⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\829.tmp"C:\Users\Admin\AppData\Local\Temp\829.tmp"110⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"111⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"112⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\9AF.tmp"C:\Users\Admin\AppData\Local\Temp\9AF.tmp"113⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"114⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"115⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp"116⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\B94.tmp"C:\Users\Admin\AppData\Local\Temp\B94.tmp"117⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"118⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"119⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"120⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"121⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"122⤵PID:840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-