Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2024 15:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe
-
Size
486KB
-
MD5
97632237bba8dcb443914e9332b666b2
-
SHA1
ab04d6e341baad036c0085289126c4ca6278fe75
-
SHA256
bed567898f24151d7b5c5ea075af06902e2f12263e47fc4d0aaa882b05105b26
-
SHA512
6744bda6088db295865470fb618b8e2cee33558427f972f1a4f8e3568486e5534ca3593d7bd27c4eaf4cdd116add007aa79677e27a262d21ecc096f90bb4ff44
-
SSDEEP
12288:/U5rCOTeiD2Nk/oH87ic7dYPRA1wP55NZ:/UQOJDL/oc7iaYPRHDN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4672 65BF.tmp 1328 666B.tmp 1860 6716.tmp 2668 6820.tmp 2528 68FB.tmp 5080 69B6.tmp 2632 6A91.tmp 4344 6B5C.tmp 4360 6BF8.tmp 4744 6C85.tmp 3032 6D12.tmp 2060 6DCD.tmp 4152 6E69.tmp 2068 6F54.tmp 1952 701F.tmp 1012 70DA.tmp 2500 7251.tmp 3228 733C.tmp 1280 7417.tmp 3948 74B3.tmp 4484 756E.tmp 5116 761A.tmp 8 76B6.tmp 4564 7791.tmp 4432 784D.tmp 2492 7908.tmp 2364 7976.tmp 2268 7A41.tmp 3940 7B0C.tmp 4476 7C06.tmp 4788 7C92.tmp 2932 7D5E.tmp 4524 7E19.tmp 3108 7E86.tmp 4144 7F23.tmp 4724 7FBF.tmp 4720 803C.tmp 1984 80B9.tmp 4984 8155.tmp 1512 81F1.tmp 4260 827E.tmp 3668 831A.tmp 4472 83B7.tmp 400 8453.tmp 3640 84DF.tmp 4548 857C.tmp 816 8608.tmp 2192 8695.tmp 1324 86F3.tmp 5044 8760.tmp 4540 87BE.tmp 2308 884A.tmp 3008 88D7.tmp 3192 8973.tmp 4320 89E1.tmp 4368 8A5E.tmp 1076 8AEA.tmp 4436 8B77.tmp 1716 8C04.tmp 3636 8C71.tmp 2884 8CDE.tmp 3520 8D4C.tmp 4556 8DB9.tmp 2412 8E46.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2224 wrote to memory of 4672 2224 2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe 83 PID 2224 wrote to memory of 4672 2224 2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe 83 PID 2224 wrote to memory of 4672 2224 2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe 83 PID 4672 wrote to memory of 1328 4672 65BF.tmp 84 PID 4672 wrote to memory of 1328 4672 65BF.tmp 84 PID 4672 wrote to memory of 1328 4672 65BF.tmp 84 PID 1328 wrote to memory of 1860 1328 666B.tmp 85 PID 1328 wrote to memory of 1860 1328 666B.tmp 85 PID 1328 wrote to memory of 1860 1328 666B.tmp 85 PID 1860 wrote to memory of 2668 1860 6716.tmp 86 PID 1860 wrote to memory of 2668 1860 6716.tmp 86 PID 1860 wrote to memory of 2668 1860 6716.tmp 86 PID 2668 wrote to memory of 2528 2668 6820.tmp 87 PID 2668 wrote to memory of 2528 2668 6820.tmp 87 PID 2668 wrote to memory of 2528 2668 6820.tmp 87 PID 2528 wrote to memory of 5080 2528 68FB.tmp 88 PID 2528 wrote to memory of 5080 2528 68FB.tmp 88 PID 2528 wrote to memory of 5080 2528 68FB.tmp 88 PID 5080 wrote to memory of 2632 5080 69B6.tmp 89 PID 5080 wrote to memory of 2632 5080 69B6.tmp 89 PID 5080 wrote to memory of 2632 5080 69B6.tmp 89 PID 2632 wrote to memory of 4344 2632 6A91.tmp 90 PID 2632 wrote to memory of 4344 2632 6A91.tmp 90 PID 2632 wrote to memory of 4344 2632 6A91.tmp 90 PID 4344 wrote to memory of 4360 4344 6B5C.tmp 91 PID 4344 wrote to memory of 4360 4344 6B5C.tmp 91 PID 4344 wrote to memory of 4360 4344 6B5C.tmp 91 PID 4360 wrote to memory of 4744 4360 6BF8.tmp 92 PID 4360 wrote to memory of 4744 4360 6BF8.tmp 92 PID 4360 wrote to memory of 4744 4360 6BF8.tmp 92 PID 4744 wrote to memory of 3032 4744 6C85.tmp 93 PID 4744 wrote to memory of 3032 4744 6C85.tmp 93 PID 4744 wrote to memory of 3032 4744 6C85.tmp 93 PID 3032 wrote to memory of 2060 3032 6D12.tmp 94 PID 3032 wrote to memory of 2060 3032 6D12.tmp 94 PID 3032 wrote to memory of 2060 3032 6D12.tmp 94 PID 2060 wrote to memory of 4152 2060 6DCD.tmp 95 PID 2060 wrote to memory of 4152 2060 6DCD.tmp 95 PID 2060 wrote to memory of 4152 2060 6DCD.tmp 95 PID 4152 wrote to memory of 2068 4152 6E69.tmp 96 PID 4152 wrote to memory of 2068 4152 6E69.tmp 96 PID 4152 wrote to memory of 2068 4152 6E69.tmp 96 PID 2068 wrote to memory of 1952 2068 6F54.tmp 97 PID 2068 wrote to memory of 1952 2068 6F54.tmp 97 PID 2068 wrote to memory of 1952 2068 6F54.tmp 97 PID 1952 wrote to memory of 1012 1952 701F.tmp 98 PID 1952 wrote to memory of 1012 1952 701F.tmp 98 PID 1952 wrote to memory of 1012 1952 701F.tmp 98 PID 1012 wrote to memory of 2500 1012 70DA.tmp 99 PID 1012 wrote to memory of 2500 1012 70DA.tmp 99 PID 1012 wrote to memory of 2500 1012 70DA.tmp 99 PID 2500 wrote to memory of 3228 2500 7251.tmp 100 PID 2500 wrote to memory of 3228 2500 7251.tmp 100 PID 2500 wrote to memory of 3228 2500 7251.tmp 100 PID 3228 wrote to memory of 1280 3228 733C.tmp 101 PID 3228 wrote to memory of 1280 3228 733C.tmp 101 PID 3228 wrote to memory of 1280 3228 733C.tmp 101 PID 1280 wrote to memory of 3948 1280 7417.tmp 102 PID 1280 wrote to memory of 3948 1280 7417.tmp 102 PID 1280 wrote to memory of 3948 1280 7417.tmp 102 PID 3948 wrote to memory of 4484 3948 74B3.tmp 103 PID 3948 wrote to memory of 4484 3948 74B3.tmp 103 PID 3948 wrote to memory of 4484 3948 74B3.tmp 103 PID 4484 wrote to memory of 5116 4484 756E.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_97632237bba8dcb443914e9332b666b2_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"23⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"24⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"25⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"26⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"27⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"28⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"29⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"30⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"31⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"32⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"33⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"34⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"35⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"36⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"37⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"38⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"39⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"40⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"41⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"42⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"43⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"44⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"45⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"46⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"47⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"48⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"49⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"50⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"51⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"52⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"53⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"54⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"55⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"56⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"57⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"58⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"59⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"60⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"61⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"62⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"63⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"64⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"65⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"66⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"67⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"68⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"69⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"70⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"71⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"72⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"73⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"74⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"75⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"76⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"77⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"78⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"79⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"80⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"81⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"82⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"83⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"84⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"85⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"86⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"87⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"88⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"89⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"90⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"91⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"92⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"93⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"94⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"95⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"96⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"97⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"98⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"99⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"100⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"101⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"102⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"103⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"104⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"105⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"106⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"107⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"108⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"109⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"110⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"111⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"112⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"113⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"114⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"115⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"116⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"117⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"118⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"119⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"120⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"121⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"122⤵PID:2204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-