Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2024 17:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe
-
Size
765KB
-
MD5
33689ed8fded1a045fc96dcce8b33872
-
SHA1
5825ea0f001dfa8ba7d797081ca638cbbbd0e21a
-
SHA256
de5ef77290fdcfb4834a915db641e2607ed5a3730d4591cdbb19465bbfdeff4e
-
SHA512
cf8afec0ea0e582d58f4f0ca732a460226ac00183032594ebf62daef976d30a412351fc8dcc0cda42c1d462c5451668c4e8482c931272a2c2d5ce70b26dbd46a
-
SSDEEP
12288:ZU5rCOTeiDpTRuQhqV36SSze/5uAE0S8gOV+1jRN3ZF5rn5rLOa54U5w5A:ZUQOJDHo0Fq/mOVGdN3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 504 7714.tmp 4292 782D.tmp 956 78F9.tmp 4672 79B4.tmp 3728 7A60.tmp 936 7AFC.tmp 3300 7C54.tmp 4312 7CF0.tmp 1784 7DAC.tmp 1260 7E67.tmp 3708 7F80.tmp 3748 806B.tmp 5016 8146.tmp 4260 8230.tmp 2988 82EB.tmp 4496 83F5.tmp 4876 84C0.tmp 4492 8685.tmp 2320 8750.tmp 3780 881C.tmp 2472 8935.tmp 2852 89F0.tmp 3992 8A5E.tmp 4004 8B0A.tmp 444 8BC5.tmp 2672 8CCF.tmp 2136 8DA9.tmp 1452 8E46.tmp 2232 8F30.tmp 3588 901A.tmp 2024 90F5.tmp 3676 91E0.tmp 4400 92BA.tmp 2000 9357.tmp 3320 9402.tmp 2276 947F.tmp 3712 950C.tmp 4972 9599.tmp 3196 9635.tmp 5116 96B2.tmp 4084 973F.tmp 2504 97BC.tmp 4056 9848.tmp 2628 98D5.tmp 1472 9961.tmp 5076 99FE.tmp 4328 9A6B.tmp 2184 9AF8.tmp 4652 9B75.tmp 3724 9BE2.tmp 2008 9C7E.tmp 4348 9D0B.tmp 4412 9D98.tmp 4396 9E24.tmp 3252 9EA1.tmp 3516 9F0F.tmp 3232 9F9B.tmp 2224 A028.tmp 4164 A095.tmp 1648 A141.tmp 2632 A1CE.tmp 4692 A26A.tmp 1196 A2E7.tmp 1772 A374.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3988 wrote to memory of 504 3988 2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe 84 PID 3988 wrote to memory of 504 3988 2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe 84 PID 3988 wrote to memory of 504 3988 2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe 84 PID 504 wrote to memory of 4292 504 7714.tmp 85 PID 504 wrote to memory of 4292 504 7714.tmp 85 PID 504 wrote to memory of 4292 504 7714.tmp 85 PID 4292 wrote to memory of 956 4292 782D.tmp 86 PID 4292 wrote to memory of 956 4292 782D.tmp 86 PID 4292 wrote to memory of 956 4292 782D.tmp 86 PID 956 wrote to memory of 4672 956 78F9.tmp 87 PID 956 wrote to memory of 4672 956 78F9.tmp 87 PID 956 wrote to memory of 4672 956 78F9.tmp 87 PID 4672 wrote to memory of 3728 4672 79B4.tmp 88 PID 4672 wrote to memory of 3728 4672 79B4.tmp 88 PID 4672 wrote to memory of 3728 4672 79B4.tmp 88 PID 3728 wrote to memory of 936 3728 7A60.tmp 89 PID 3728 wrote to memory of 936 3728 7A60.tmp 89 PID 3728 wrote to memory of 936 3728 7A60.tmp 89 PID 936 wrote to memory of 3300 936 7AFC.tmp 90 PID 936 wrote to memory of 3300 936 7AFC.tmp 90 PID 936 wrote to memory of 3300 936 7AFC.tmp 90 PID 3300 wrote to memory of 4312 3300 7C54.tmp 91 PID 3300 wrote to memory of 4312 3300 7C54.tmp 91 PID 3300 wrote to memory of 4312 3300 7C54.tmp 91 PID 4312 wrote to memory of 1784 4312 7CF0.tmp 92 PID 4312 wrote to memory of 1784 4312 7CF0.tmp 92 PID 4312 wrote to memory of 1784 4312 7CF0.tmp 92 PID 1784 wrote to memory of 1260 1784 7DAC.tmp 93 PID 1784 wrote to memory of 1260 1784 7DAC.tmp 93 PID 1784 wrote to memory of 1260 1784 7DAC.tmp 93 PID 1260 wrote to memory of 3708 1260 7E67.tmp 94 PID 1260 wrote to memory of 3708 1260 7E67.tmp 94 PID 1260 wrote to memory of 3708 1260 7E67.tmp 94 PID 3708 wrote to memory of 3748 3708 7F80.tmp 95 PID 3708 wrote to memory of 3748 3708 7F80.tmp 95 PID 3708 wrote to memory of 3748 3708 7F80.tmp 95 PID 3748 wrote to memory of 5016 3748 806B.tmp 96 PID 3748 wrote to memory of 5016 3748 806B.tmp 96 PID 3748 wrote to memory of 5016 3748 806B.tmp 96 PID 5016 wrote to memory of 4260 5016 8146.tmp 97 PID 5016 wrote to memory of 4260 5016 8146.tmp 97 PID 5016 wrote to memory of 4260 5016 8146.tmp 97 PID 4260 wrote to memory of 2988 4260 8230.tmp 98 PID 4260 wrote to memory of 2988 4260 8230.tmp 98 PID 4260 wrote to memory of 2988 4260 8230.tmp 98 PID 2988 wrote to memory of 4496 2988 82EB.tmp 99 PID 2988 wrote to memory of 4496 2988 82EB.tmp 99 PID 2988 wrote to memory of 4496 2988 82EB.tmp 99 PID 4496 wrote to memory of 4876 4496 83F5.tmp 100 PID 4496 wrote to memory of 4876 4496 83F5.tmp 100 PID 4496 wrote to memory of 4876 4496 83F5.tmp 100 PID 4876 wrote to memory of 4492 4876 84C0.tmp 101 PID 4876 wrote to memory of 4492 4876 84C0.tmp 101 PID 4876 wrote to memory of 4492 4876 84C0.tmp 101 PID 4492 wrote to memory of 2320 4492 8685.tmp 102 PID 4492 wrote to memory of 2320 4492 8685.tmp 102 PID 4492 wrote to memory of 2320 4492 8685.tmp 102 PID 2320 wrote to memory of 3780 2320 8750.tmp 103 PID 2320 wrote to memory of 3780 2320 8750.tmp 103 PID 2320 wrote to memory of 3780 2320 8750.tmp 103 PID 3780 wrote to memory of 2472 3780 881C.tmp 104 PID 3780 wrote to memory of 2472 3780 881C.tmp 104 PID 3780 wrote to memory of 2472 3780 881C.tmp 104 PID 2472 wrote to memory of 2852 2472 8935.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_33689ed8fded1a045fc96dcce8b33872_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"23⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"24⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"25⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"26⤵
- Executes dropped EXE
PID:444 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"27⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"28⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"29⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"30⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"31⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"32⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"33⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"34⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"35⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"36⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"37⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"38⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"39⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"40⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"41⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"42⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"43⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"44⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"45⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"46⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"47⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"48⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"49⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"50⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"51⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"52⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"53⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"54⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"55⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"56⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"57⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"58⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"59⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"60⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"61⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"62⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"63⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"64⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"65⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"66⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"67⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"68⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"69⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"70⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"71⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"72⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"73⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"74⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"75⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"76⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"77⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"78⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"79⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"80⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"81⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"82⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"83⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"84⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"85⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"86⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"87⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"88⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"89⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"90⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"91⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"92⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"93⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"94⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"95⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"96⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"97⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"98⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"99⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"100⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"101⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"102⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"103⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"104⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"105⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"106⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"107⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"108⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"109⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"110⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"111⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"112⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"113⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"114⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"115⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"116⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"117⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"118⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"119⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"120⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"121⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"122⤵PID:1412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-