Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2024, 15:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe
-
Size
488KB
-
MD5
ad2d7ec2ad8ddef4134fdfe9c6a82a01
-
SHA1
908185f48224608b7cdf40bfc055303b67f6b66a
-
SHA256
f65b4006eb0296635050bace8715d0a5c85fcb9f7c0183fb8d6c27c24c9ce3a5
-
SHA512
87f61c062801b8bb9912616dd169c9f47ee6e6118e13c1a6685d8ad1abcd4638d0d9bff186b16e4259c27e3d880633444f97d35d7b2e2ae125b4d69dfc72bdef
-
SSDEEP
12288:/U5rCOTeiDhU+POiv9jcztwfRw968j0MNZ:/UQOJDlP3eW5+68IMN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2860 7EB5.tmp 1744 7F90.tmp 1236 802C.tmp 4228 80F7.tmp 4128 81C3.tmp 3384 82AD.tmp 4308 8378.tmp 4184 8462.tmp 4668 850E.tmp 3204 85AB.tmp 4968 8656.tmp 2924 86F3.tmp 3592 87BE.tmp 2436 88A8.tmp 3836 8954.tmp 2716 8A10.tmp 2324 8A9C.tmp 1656 8B87.tmp 1028 8C52.tmp 832 8CDE.tmp 4468 8E17.tmp 3516 8EE2.tmp 3404 8F8E.tmp 4896 900B.tmp 4580 90F5.tmp 4476 91D0.tmp 3972 926C.tmp 1188 9357.tmp 4780 9422.tmp 1316 94AE.tmp 2032 956A.tmp 4992 9606.tmp 2808 96C2.tmp 3576 976D.tmp 4520 9819.tmp 3348 9887.tmp 392 9923.tmp 3544 99B0.tmp 5104 9A3C.tmp 3124 9AC9.tmp 2992 9B65.tmp 1988 9BD2.tmp 5008 9C5F.tmp 3988 9CEC.tmp 956 9D78.tmp 3980 9E05.tmp 4172 9E92.tmp 3724 9F2E.tmp 4024 9FDA.tmp 4140 A057.tmp 3556 A0E3.tmp 3004 A180.tmp 3232 A299.tmp 3220 A316.tmp 4448 A393.tmp 1268 A410.tmp 660 A47D.tmp 2860 A4DB.tmp 5032 A568.tmp 1788 A5D5.tmp 1896 A642.tmp 2316 A6DF.tmp 4228 A75C.tmp 4128 A7D9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3180 wrote to memory of 2860 3180 2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe 84 PID 3180 wrote to memory of 2860 3180 2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe 84 PID 3180 wrote to memory of 2860 3180 2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe 84 PID 2860 wrote to memory of 1744 2860 7EB5.tmp 85 PID 2860 wrote to memory of 1744 2860 7EB5.tmp 85 PID 2860 wrote to memory of 1744 2860 7EB5.tmp 85 PID 1744 wrote to memory of 1236 1744 7F90.tmp 86 PID 1744 wrote to memory of 1236 1744 7F90.tmp 86 PID 1744 wrote to memory of 1236 1744 7F90.tmp 86 PID 1236 wrote to memory of 4228 1236 802C.tmp 87 PID 1236 wrote to memory of 4228 1236 802C.tmp 87 PID 1236 wrote to memory of 4228 1236 802C.tmp 87 PID 4228 wrote to memory of 4128 4228 80F7.tmp 88 PID 4228 wrote to memory of 4128 4228 80F7.tmp 88 PID 4228 wrote to memory of 4128 4228 80F7.tmp 88 PID 4128 wrote to memory of 3384 4128 81C3.tmp 89 PID 4128 wrote to memory of 3384 4128 81C3.tmp 89 PID 4128 wrote to memory of 3384 4128 81C3.tmp 89 PID 3384 wrote to memory of 4308 3384 82AD.tmp 90 PID 3384 wrote to memory of 4308 3384 82AD.tmp 90 PID 3384 wrote to memory of 4308 3384 82AD.tmp 90 PID 4308 wrote to memory of 4184 4308 8378.tmp 91 PID 4308 wrote to memory of 4184 4308 8378.tmp 91 PID 4308 wrote to memory of 4184 4308 8378.tmp 91 PID 4184 wrote to memory of 4668 4184 8462.tmp 92 PID 4184 wrote to memory of 4668 4184 8462.tmp 92 PID 4184 wrote to memory of 4668 4184 8462.tmp 92 PID 4668 wrote to memory of 3204 4668 850E.tmp 93 PID 4668 wrote to memory of 3204 4668 850E.tmp 93 PID 4668 wrote to memory of 3204 4668 850E.tmp 93 PID 3204 wrote to memory of 4968 3204 85AB.tmp 94 PID 3204 wrote to memory of 4968 3204 85AB.tmp 94 PID 3204 wrote to memory of 4968 3204 85AB.tmp 94 PID 4968 wrote to memory of 2924 4968 8656.tmp 95 PID 4968 wrote to memory of 2924 4968 8656.tmp 95 PID 4968 wrote to memory of 2924 4968 8656.tmp 95 PID 2924 wrote to memory of 3592 2924 86F3.tmp 96 PID 2924 wrote to memory of 3592 2924 86F3.tmp 96 PID 2924 wrote to memory of 3592 2924 86F3.tmp 96 PID 3592 wrote to memory of 2436 3592 87BE.tmp 97 PID 3592 wrote to memory of 2436 3592 87BE.tmp 97 PID 3592 wrote to memory of 2436 3592 87BE.tmp 97 PID 2436 wrote to memory of 3836 2436 88A8.tmp 98 PID 2436 wrote to memory of 3836 2436 88A8.tmp 98 PID 2436 wrote to memory of 3836 2436 88A8.tmp 98 PID 3836 wrote to memory of 2716 3836 8954.tmp 99 PID 3836 wrote to memory of 2716 3836 8954.tmp 99 PID 3836 wrote to memory of 2716 3836 8954.tmp 99 PID 2716 wrote to memory of 2324 2716 8A10.tmp 100 PID 2716 wrote to memory of 2324 2716 8A10.tmp 100 PID 2716 wrote to memory of 2324 2716 8A10.tmp 100 PID 2324 wrote to memory of 1656 2324 8A9C.tmp 101 PID 2324 wrote to memory of 1656 2324 8A9C.tmp 101 PID 2324 wrote to memory of 1656 2324 8A9C.tmp 101 PID 1656 wrote to memory of 1028 1656 8B87.tmp 102 PID 1656 wrote to memory of 1028 1656 8B87.tmp 102 PID 1656 wrote to memory of 1028 1656 8B87.tmp 102 PID 1028 wrote to memory of 832 1028 8C52.tmp 103 PID 1028 wrote to memory of 832 1028 8C52.tmp 103 PID 1028 wrote to memory of 832 1028 8C52.tmp 103 PID 832 wrote to memory of 4468 832 8CDE.tmp 104 PID 832 wrote to memory of 4468 832 8CDE.tmp 104 PID 832 wrote to memory of 4468 832 8CDE.tmp 104 PID 4468 wrote to memory of 3516 4468 8E17.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_ad2d7ec2ad8ddef4134fdfe9c6a82a01_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"23⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"24⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"25⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"26⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"27⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"28⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"29⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"30⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"31⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"32⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"33⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"34⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"35⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"36⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"37⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"38⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"39⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"40⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"41⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"42⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"43⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"44⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"45⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"46⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"47⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"48⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"49⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"50⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"51⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"52⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"53⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"54⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"55⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"56⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"57⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"58⤵
- Executes dropped EXE
PID:660 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"59⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"60⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"61⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"62⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"63⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"64⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"65⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"66⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"67⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"68⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"69⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"70⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"71⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"72⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"73⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"74⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"75⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"76⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"77⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"78⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"79⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"80⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"81⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"82⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"83⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"84⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"85⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"86⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"87⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"88⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"89⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"90⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"91⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"92⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"93⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"94⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"95⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"96⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"97⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"98⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"99⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"100⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"101⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"102⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"103⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"104⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"105⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"106⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"107⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"108⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"109⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"110⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"111⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"112⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"113⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\C38E.tmp"C:\Users\Admin\AppData\Local\Temp\C38E.tmp"114⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"115⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"116⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"117⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"118⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"119⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"120⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"121⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"122⤵PID:4336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-