Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2024 17:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-13_0301a4d6aa1f4a2b8f9152f272b0f491_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-13_0301a4d6aa1f4a2b8f9152f272b0f491_mafia.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-13_0301a4d6aa1f4a2b8f9152f272b0f491_mafia.exe
-
Size
488KB
-
MD5
0301a4d6aa1f4a2b8f9152f272b0f491
-
SHA1
6805ccb3adc246658d946521eb26f4effd24606b
-
SHA256
f7d32c87fa1c99dfb836a7df50172b5b2e0c397425a031fcac2e4c9dab180bae
-
SHA512
061d79d66d4b655b2d647d84eaba4d78b7d7476b949f3d44e587518086a4b8c83e0edbb8e3db20d7c6a431c532fc76dc47dbfb73be46b4228d204804a0e5dd1d
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7xOG0m7bYCb+d6PVRlEPOgntjBDVefEtXBTIa:/U5rCOTeiDxnhJxktja8tVRNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4176 5B01.tmp 3900 5B6E.tmp 3420 5BEB.tmp 3612 5C78.tmp 5112 5CE5.tmp 1500 5D52.tmp 1912 5DC0.tmp 1228 5E3D.tmp 2732 5E9B.tmp 4860 5F08.tmp 1676 5F56.tmp 4552 5FB4.tmp 4740 6002.tmp 2968 6050.tmp 3056 60BD.tmp 4224 612B.tmp 4372 6189.tmp 3288 6206.tmp 3060 6254.tmp 4460 62B1.tmp 1308 631F.tmp 5008 637D.tmp 4988 63DA.tmp 3092 6448.tmp 5052 64A5.tmp 4180 6503.tmp 2380 6571.tmp 912 65BF.tmp 1920 663C.tmp 2640 66B9.tmp 4472 6707.tmp 3860 6755.tmp 1760 67B3.tmp 2188 6810.tmp 3108 686E.tmp 748 68BC.tmp 2176 690A.tmp 1988 6968.tmp 4820 69B6.tmp 2516 6A14.tmp 4780 6A62.tmp 2880 6AB0.tmp 4852 6AFE.tmp 3240 6B5C.tmp 1280 6BAA.tmp 1396 6C18.tmp 1780 6C66.tmp 4124 6CB4.tmp 1244 6D02.tmp 3996 6D60.tmp 4276 6DAE.tmp 4952 6E0C.tmp 8 6E69.tmp 872 6EC7.tmp 2528 6F25.tmp 3420 6F73.tmp 2084 6FC1.tmp 3612 701F.tmp 5112 707D.tmp 2448 70DA.tmp 4048 7138.tmp 2388 7196.tmp 3384 71E4.tmp 5000 7242.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1996 wrote to memory of 4176 1996 2024-02-13_0301a4d6aa1f4a2b8f9152f272b0f491_mafia.exe 84 PID 1996 wrote to memory of 4176 1996 2024-02-13_0301a4d6aa1f4a2b8f9152f272b0f491_mafia.exe 84 PID 1996 wrote to memory of 4176 1996 2024-02-13_0301a4d6aa1f4a2b8f9152f272b0f491_mafia.exe 84 PID 4176 wrote to memory of 3900 4176 5B01.tmp 85 PID 4176 wrote to memory of 3900 4176 5B01.tmp 85 PID 4176 wrote to memory of 3900 4176 5B01.tmp 85 PID 3900 wrote to memory of 3420 3900 5B6E.tmp 86 PID 3900 wrote to memory of 3420 3900 5B6E.tmp 86 PID 3900 wrote to memory of 3420 3900 5B6E.tmp 86 PID 3420 wrote to memory of 3612 3420 5BEB.tmp 87 PID 3420 wrote to memory of 3612 3420 5BEB.tmp 87 PID 3420 wrote to memory of 3612 3420 5BEB.tmp 87 PID 3612 wrote to memory of 5112 3612 5C78.tmp 88 PID 3612 wrote to memory of 5112 3612 5C78.tmp 88 PID 3612 wrote to memory of 5112 3612 5C78.tmp 88 PID 5112 wrote to memory of 1500 5112 5CE5.tmp 89 PID 5112 wrote to memory of 1500 5112 5CE5.tmp 89 PID 5112 wrote to memory of 1500 5112 5CE5.tmp 89 PID 1500 wrote to memory of 1912 1500 5D52.tmp 90 PID 1500 wrote to memory of 1912 1500 5D52.tmp 90 PID 1500 wrote to memory of 1912 1500 5D52.tmp 90 PID 1912 wrote to memory of 1228 1912 5DC0.tmp 91 PID 1912 wrote to memory of 1228 1912 5DC0.tmp 91 PID 1912 wrote to memory of 1228 1912 5DC0.tmp 91 PID 1228 wrote to memory of 2732 1228 5E3D.tmp 92 PID 1228 wrote to memory of 2732 1228 5E3D.tmp 92 PID 1228 wrote to memory of 2732 1228 5E3D.tmp 92 PID 2732 wrote to memory of 4860 2732 5E9B.tmp 93 PID 2732 wrote to memory of 4860 2732 5E9B.tmp 93 PID 2732 wrote to memory of 4860 2732 5E9B.tmp 93 PID 4860 wrote to memory of 1676 4860 5F08.tmp 94 PID 4860 wrote to memory of 1676 4860 5F08.tmp 94 PID 4860 wrote to memory of 1676 4860 5F08.tmp 94 PID 1676 wrote to memory of 4552 1676 5F56.tmp 95 PID 1676 wrote to memory of 4552 1676 5F56.tmp 95 PID 1676 wrote to memory of 4552 1676 5F56.tmp 95 PID 4552 wrote to memory of 4740 4552 5FB4.tmp 96 PID 4552 wrote to memory of 4740 4552 5FB4.tmp 96 PID 4552 wrote to memory of 4740 4552 5FB4.tmp 96 PID 4740 wrote to memory of 2968 4740 6002.tmp 97 PID 4740 wrote to memory of 2968 4740 6002.tmp 97 PID 4740 wrote to memory of 2968 4740 6002.tmp 97 PID 2968 wrote to memory of 3056 2968 6050.tmp 98 PID 2968 wrote to memory of 3056 2968 6050.tmp 98 PID 2968 wrote to memory of 3056 2968 6050.tmp 98 PID 3056 wrote to memory of 4224 3056 60BD.tmp 99 PID 3056 wrote to memory of 4224 3056 60BD.tmp 99 PID 3056 wrote to memory of 4224 3056 60BD.tmp 99 PID 4224 wrote to memory of 4372 4224 612B.tmp 100 PID 4224 wrote to memory of 4372 4224 612B.tmp 100 PID 4224 wrote to memory of 4372 4224 612B.tmp 100 PID 4372 wrote to memory of 3288 4372 6189.tmp 101 PID 4372 wrote to memory of 3288 4372 6189.tmp 101 PID 4372 wrote to memory of 3288 4372 6189.tmp 101 PID 3288 wrote to memory of 3060 3288 6206.tmp 102 PID 3288 wrote to memory of 3060 3288 6206.tmp 102 PID 3288 wrote to memory of 3060 3288 6206.tmp 102 PID 3060 wrote to memory of 4460 3060 6254.tmp 103 PID 3060 wrote to memory of 4460 3060 6254.tmp 103 PID 3060 wrote to memory of 4460 3060 6254.tmp 103 PID 4460 wrote to memory of 1308 4460 62B1.tmp 104 PID 4460 wrote to memory of 1308 4460 62B1.tmp 104 PID 4460 wrote to memory of 1308 4460 62B1.tmp 104 PID 1308 wrote to memory of 5008 1308 631F.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_0301a4d6aa1f4a2b8f9152f272b0f491_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_0301a4d6aa1f4a2b8f9152f272b0f491_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"23⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"24⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"25⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"26⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"27⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"28⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"29⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"30⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"31⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"32⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"33⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"34⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"35⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"36⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"37⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"38⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"39⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"40⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"41⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"42⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"43⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"44⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"45⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"46⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"47⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"48⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"49⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"50⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"51⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"52⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"53⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"54⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"55⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"56⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"57⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"58⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"59⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"60⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"61⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"62⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"63⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"64⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"65⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"66⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"67⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"68⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"69⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"70⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"71⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"72⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"73⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"74⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"75⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"76⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"77⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"78⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"79⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"80⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"81⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"82⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"83⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"84⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"85⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"86⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"87⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"88⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"89⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"90⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"91⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"92⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"93⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"94⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"95⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"96⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"97⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"98⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"99⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"100⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"101⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"102⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"103⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"104⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"105⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"106⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"107⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"108⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"109⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"110⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\81E2.tmp"C:\Users\Admin\AppData\Local\Temp\81E2.tmp"111⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"112⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"113⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"114⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"115⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"116⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"117⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"118⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"119⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"120⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"121⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"122⤵PID:4508
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-