Analysis
-
max time kernel
153s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 15:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-29_ad8d07210ad60dad81785e85de30b14f_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-29_ad8d07210ad60dad81785e85de30b14f_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-01-29_ad8d07210ad60dad81785e85de30b14f_mafia.exe
-
Size
488KB
-
MD5
ad8d07210ad60dad81785e85de30b14f
-
SHA1
d62ba15d46c4ed662734ce86c9930b18c1f6d9a7
-
SHA256
411b1417ee87127ad30abf5e7c2edab59ab9e9bf4c0353b588100a404afef7c0
-
SHA512
d41d62498e8f1d878eec3eb8a6f6097087c70af22833e8748b0325ee08c28eb8916b75e69f21354442a578b0f3be88820faec9dadb98a5e5de97d6351ffb59f6
-
SSDEEP
12288:/U5rCOTeiDIcmS220bdXfPUwFQaSZXzcX88KNZ:/UQOJDIch0b6vaSZjcMRN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1920 BEFA.tmp 4972 C18B.tmp 1488 C285.tmp 2964 C38E.tmp 1228 C459.tmp 4528 C5B1.tmp 4316 C6BB.tmp 828 C786.tmp 4812 C841.tmp 3684 C90D.tmp 5008 CA07.tmp 2384 CB01.tmp 3168 CBBC.tmp 3172 CCA6.tmp 1708 CD52.tmp 3364 CE4C.tmp 4792 CF27.tmp 1980 D002.tmp 2524 D13A.tmp 4260 D225.tmp 4796 D31F.tmp 4696 D3EA.tmp 3436 D4A5.tmp 1344 D580.tmp 2776 D62C.tmp 2464 D6B9.tmp 4512 D764.tmp 3164 D801.tmp 4284 D8CC.tmp 3116 D958.tmp 408 D9F5.tmp 1608 DA91.tmp 5004 DB2D.tmp 4668 DBAA.tmp 2636 DC18.tmp 628 DCA4.tmp 3188 DD31.tmp 4784 DDAE.tmp 4440 DE79.tmp 5060 DF06.tmp 1276 DF92.tmp 932 DFF0.tmp 2596 E08C.tmp 4372 E0EA.tmp 4592 E1A5.tmp 4204 E280.tmp 4704 E3B9.tmp 4536 E465.tmp 3592 E501.tmp 2980 E58D.tmp 4804 E5FB.tmp 208 E687.tmp 4628 E762.tmp 2988 E81E.tmp 2964 E947.tmp 4264 E9B4.tmp 388 EA41.tmp 5056 EABE.tmp 4912 EB4A.tmp 4000 EBB8.tmp 4084 EC44.tmp 3212 ECB2.tmp 2692 ED3E.tmp 4228 EDBB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3412 wrote to memory of 1920 3412 2024-01-29_ad8d07210ad60dad81785e85de30b14f_mafia.exe 84 PID 3412 wrote to memory of 1920 3412 2024-01-29_ad8d07210ad60dad81785e85de30b14f_mafia.exe 84 PID 3412 wrote to memory of 1920 3412 2024-01-29_ad8d07210ad60dad81785e85de30b14f_mafia.exe 84 PID 1920 wrote to memory of 4972 1920 BEFA.tmp 85 PID 1920 wrote to memory of 4972 1920 BEFA.tmp 85 PID 1920 wrote to memory of 4972 1920 BEFA.tmp 85 PID 4972 wrote to memory of 1488 4972 C18B.tmp 86 PID 4972 wrote to memory of 1488 4972 C18B.tmp 86 PID 4972 wrote to memory of 1488 4972 C18B.tmp 86 PID 1488 wrote to memory of 2964 1488 C285.tmp 87 PID 1488 wrote to memory of 2964 1488 C285.tmp 87 PID 1488 wrote to memory of 2964 1488 C285.tmp 87 PID 2964 wrote to memory of 1228 2964 C38E.tmp 88 PID 2964 wrote to memory of 1228 2964 C38E.tmp 88 PID 2964 wrote to memory of 1228 2964 C38E.tmp 88 PID 1228 wrote to memory of 4528 1228 C459.tmp 89 PID 1228 wrote to memory of 4528 1228 C459.tmp 89 PID 1228 wrote to memory of 4528 1228 C459.tmp 89 PID 4528 wrote to memory of 4316 4528 C5B1.tmp 90 PID 4528 wrote to memory of 4316 4528 C5B1.tmp 90 PID 4528 wrote to memory of 4316 4528 C5B1.tmp 90 PID 4316 wrote to memory of 828 4316 C6BB.tmp 91 PID 4316 wrote to memory of 828 4316 C6BB.tmp 91 PID 4316 wrote to memory of 828 4316 C6BB.tmp 91 PID 828 wrote to memory of 4812 828 C786.tmp 92 PID 828 wrote to memory of 4812 828 C786.tmp 92 PID 828 wrote to memory of 4812 828 C786.tmp 92 PID 4812 wrote to memory of 3684 4812 C841.tmp 93 PID 4812 wrote to memory of 3684 4812 C841.tmp 93 PID 4812 wrote to memory of 3684 4812 C841.tmp 93 PID 3684 wrote to memory of 5008 3684 C90D.tmp 94 PID 3684 wrote to memory of 5008 3684 C90D.tmp 94 PID 3684 wrote to memory of 5008 3684 C90D.tmp 94 PID 5008 wrote to memory of 2384 5008 CA07.tmp 95 PID 5008 wrote to memory of 2384 5008 CA07.tmp 95 PID 5008 wrote to memory of 2384 5008 CA07.tmp 95 PID 2384 wrote to memory of 3168 2384 CB01.tmp 96 PID 2384 wrote to memory of 3168 2384 CB01.tmp 96 PID 2384 wrote to memory of 3168 2384 CB01.tmp 96 PID 3168 wrote to memory of 3172 3168 CBBC.tmp 97 PID 3168 wrote to memory of 3172 3168 CBBC.tmp 97 PID 3168 wrote to memory of 3172 3168 CBBC.tmp 97 PID 3172 wrote to memory of 1708 3172 CCA6.tmp 98 PID 3172 wrote to memory of 1708 3172 CCA6.tmp 98 PID 3172 wrote to memory of 1708 3172 CCA6.tmp 98 PID 1708 wrote to memory of 3364 1708 CD52.tmp 99 PID 1708 wrote to memory of 3364 1708 CD52.tmp 99 PID 1708 wrote to memory of 3364 1708 CD52.tmp 99 PID 3364 wrote to memory of 4792 3364 CE4C.tmp 100 PID 3364 wrote to memory of 4792 3364 CE4C.tmp 100 PID 3364 wrote to memory of 4792 3364 CE4C.tmp 100 PID 4792 wrote to memory of 1980 4792 CF27.tmp 101 PID 4792 wrote to memory of 1980 4792 CF27.tmp 101 PID 4792 wrote to memory of 1980 4792 CF27.tmp 101 PID 1980 wrote to memory of 2524 1980 D002.tmp 102 PID 1980 wrote to memory of 2524 1980 D002.tmp 102 PID 1980 wrote to memory of 2524 1980 D002.tmp 102 PID 2524 wrote to memory of 4260 2524 D13A.tmp 103 PID 2524 wrote to memory of 4260 2524 D13A.tmp 103 PID 2524 wrote to memory of 4260 2524 D13A.tmp 103 PID 4260 wrote to memory of 4796 4260 D225.tmp 104 PID 4260 wrote to memory of 4796 4260 D225.tmp 104 PID 4260 wrote to memory of 4796 4260 D225.tmp 104 PID 4796 wrote to memory of 4696 4796 D31F.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-29_ad8d07210ad60dad81785e85de30b14f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-29_ad8d07210ad60dad81785e85de30b14f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\C38E.tmp"C:\Users\Admin\AppData\Local\Temp\C38E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\CD52.tmp"C:\Users\Admin\AppData\Local\Temp\CD52.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\D002.tmp"C:\Users\Admin\AppData\Local\Temp\D002.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\D31F.tmp"C:\Users\Admin\AppData\Local\Temp\D31F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"23⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"24⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\D580.tmp"C:\Users\Admin\AppData\Local\Temp\D580.tmp"25⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"26⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"27⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"28⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\D801.tmp"C:\Users\Admin\AppData\Local\Temp\D801.tmp"29⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"30⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\D958.tmp"C:\Users\Admin\AppData\Local\Temp\D958.tmp"31⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"32⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\DA91.tmp"C:\Users\Admin\AppData\Local\Temp\DA91.tmp"33⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"34⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"35⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"36⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"37⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\DD31.tmp"C:\Users\Admin\AppData\Local\Temp\DD31.tmp"38⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"39⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\DE79.tmp"C:\Users\Admin\AppData\Local\Temp\DE79.tmp"40⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\DF06.tmp"C:\Users\Admin\AppData\Local\Temp\DF06.tmp"41⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\DF92.tmp"C:\Users\Admin\AppData\Local\Temp\DF92.tmp"42⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"43⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"44⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"45⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"46⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"47⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"48⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"49⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"50⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\E58D.tmp"C:\Users\Admin\AppData\Local\Temp\E58D.tmp"51⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"52⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\E687.tmp"C:\Users\Admin\AppData\Local\Temp\E687.tmp"53⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"54⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"55⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\E947.tmp"C:\Users\Admin\AppData\Local\Temp\E947.tmp"56⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"57⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\EA41.tmp"C:\Users\Admin\AppData\Local\Temp\EA41.tmp"58⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"59⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"60⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"61⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"62⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"63⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"64⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"65⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\EE96.tmp"C:\Users\Admin\AppData\Local\Temp\EE96.tmp"66⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"67⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"68⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"69⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\F07A.tmp"C:\Users\Admin\AppData\Local\Temp\F07A.tmp"70⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"71⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"72⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"73⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\F24F.tmp"C:\Users\Admin\AppData\Local\Temp\F24F.tmp"74⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"75⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"76⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"77⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\F424.tmp"C:\Users\Admin\AppData\Local\Temp\F424.tmp"78⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"79⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"80⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"81⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"82⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"83⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\F760.tmp"C:\Users\Admin\AppData\Local\Temp\F760.tmp"84⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"85⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\F85A.tmp"C:\Users\Admin\AppData\Local\Temp\F85A.tmp"86⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"87⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"88⤵PID:500
-
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"89⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"90⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\FABB.tmp"C:\Users\Admin\AppData\Local\Temp\FABB.tmp"91⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\FB29.tmp"C:\Users\Admin\AppData\Local\Temp\FB29.tmp"92⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"93⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"94⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\FC90.tmp"C:\Users\Admin\AppData\Local\Temp\FC90.tmp"95⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"96⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"97⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"98⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\FE94.tmp"C:\Users\Admin\AppData\Local\Temp\FE94.tmp"99⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"100⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"101⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"102⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\78.tmp"C:\Users\Admin\AppData\Local\Temp\78.tmp"103⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\F5.tmp"C:\Users\Admin\AppData\Local\Temp\F5.tmp"104⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"105⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"106⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\2AB.tmp"C:\Users\Admin\AppData\Local\Temp\2AB.tmp"107⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\318.tmp"C:\Users\Admin\AppData\Local\Temp\318.tmp"108⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\3B4.tmp"C:\Users\Admin\AppData\Local\Temp\3B4.tmp"109⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"110⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"111⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"112⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp"113⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"114⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"115⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\78D.tmp"C:\Users\Admin\AppData\Local\Temp\78D.tmp"116⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\829.tmp"C:\Users\Admin\AppData\Local\Temp\829.tmp"117⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\896.tmp"C:\Users\Admin\AppData\Local\Temp\896.tmp"118⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"119⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"120⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\9FE.tmp"C:\Users\Admin\AppData\Local\Temp\9FE.tmp"121⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"122⤵PID:5008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-