Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2024 18:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe
-
Size
488KB
-
MD5
7b97778ff9515f32542dbba3650c22c2
-
SHA1
e17b61e866876cebdde134eef9b8b393e43dd6bf
-
SHA256
6d557090a27bb0744160eed2e51459d18fcf7a433eb2238366088a04759d9231
-
SHA512
66eca310628c222c4f9abe92a90cdc7442c8aadf09c7602083e8e9e1d5ba9b5e91e7313d94729b2179e92d2869f798e9be5aa2c101351d1cb79c553e208061a9
-
SSDEEP
12288:/U5rCOTeiDlBySciL8KjA6nPEhhjn6xYp2SMNZ:/UQOJDPciL8KU6Pcz4YpTMN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3628 683F.tmp 1400 68FB.tmp 3132 69C6.tmp 2232 6A91.tmp 1736 6B5C.tmp 4308 6BF8.tmp 2160 6C95.tmp 2272 6D50.tmp 1320 6DEC.tmp 3584 6E98.tmp 4748 6F54.tmp 2044 7000.tmp 3580 70BB.tmp 3952 7196.tmp 388 7261.tmp 2460 739A.tmp 3148 7465.tmp 3632 753F.tmp 1448 75FB.tmp 2496 7697.tmp 1324 7714.tmp 2268 781E.tmp 376 78E9.tmp 1568 7995.tmp 4488 7A41.tmp 4148 7B2B.tmp 2692 7BF6.tmp 4492 7CF0.tmp 980 7DEA.tmp 4532 7EA6.tmp 2956 7F52.tmp 4808 7FFD.tmp 4836 80D8.tmp 4064 8174.tmp 1580 8201.tmp 1656 82AD.tmp 4212 833A.tmp 2300 83E5.tmp 4088 8482.tmp 4048 851E.tmp 1680 85CA.tmp 3352 8666.tmp 3180 8702.tmp 1772 879F.tmp 3404 884A.tmp 3320 88D7.tmp 2900 8964.tmp 5052 89D1.tmp 5092 8A5E.tmp 3388 8ADB.tmp 4980 8B77.tmp 1572 8BF4.tmp 4952 8D0D.tmp 3572 8DA9.tmp 3020 8E26.tmp 872 8F30.tmp 4588 8FAD.tmp 1700 9049.tmp 1424 90E6.tmp 1272 9143.tmp 4856 91B1.tmp 1468 920E.tmp 1084 928B.tmp 4264 92E9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3240 wrote to memory of 3628 3240 2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe 84 PID 3240 wrote to memory of 3628 3240 2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe 84 PID 3240 wrote to memory of 3628 3240 2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe 84 PID 3628 wrote to memory of 1400 3628 683F.tmp 85 PID 3628 wrote to memory of 1400 3628 683F.tmp 85 PID 3628 wrote to memory of 1400 3628 683F.tmp 85 PID 1400 wrote to memory of 3132 1400 68FB.tmp 86 PID 1400 wrote to memory of 3132 1400 68FB.tmp 86 PID 1400 wrote to memory of 3132 1400 68FB.tmp 86 PID 3132 wrote to memory of 2232 3132 69C6.tmp 87 PID 3132 wrote to memory of 2232 3132 69C6.tmp 87 PID 3132 wrote to memory of 2232 3132 69C6.tmp 87 PID 2232 wrote to memory of 1736 2232 6A91.tmp 88 PID 2232 wrote to memory of 1736 2232 6A91.tmp 88 PID 2232 wrote to memory of 1736 2232 6A91.tmp 88 PID 1736 wrote to memory of 4308 1736 6B5C.tmp 89 PID 1736 wrote to memory of 4308 1736 6B5C.tmp 89 PID 1736 wrote to memory of 4308 1736 6B5C.tmp 89 PID 4308 wrote to memory of 2160 4308 6BF8.tmp 90 PID 4308 wrote to memory of 2160 4308 6BF8.tmp 90 PID 4308 wrote to memory of 2160 4308 6BF8.tmp 90 PID 2160 wrote to memory of 2272 2160 6C95.tmp 91 PID 2160 wrote to memory of 2272 2160 6C95.tmp 91 PID 2160 wrote to memory of 2272 2160 6C95.tmp 91 PID 2272 wrote to memory of 1320 2272 6D50.tmp 92 PID 2272 wrote to memory of 1320 2272 6D50.tmp 92 PID 2272 wrote to memory of 1320 2272 6D50.tmp 92 PID 1320 wrote to memory of 3584 1320 6DEC.tmp 93 PID 1320 wrote to memory of 3584 1320 6DEC.tmp 93 PID 1320 wrote to memory of 3584 1320 6DEC.tmp 93 PID 3584 wrote to memory of 4748 3584 6E98.tmp 94 PID 3584 wrote to memory of 4748 3584 6E98.tmp 94 PID 3584 wrote to memory of 4748 3584 6E98.tmp 94 PID 4748 wrote to memory of 2044 4748 6F54.tmp 95 PID 4748 wrote to memory of 2044 4748 6F54.tmp 95 PID 4748 wrote to memory of 2044 4748 6F54.tmp 95 PID 2044 wrote to memory of 3580 2044 7000.tmp 96 PID 2044 wrote to memory of 3580 2044 7000.tmp 96 PID 2044 wrote to memory of 3580 2044 7000.tmp 96 PID 3580 wrote to memory of 3952 3580 70BB.tmp 97 PID 3580 wrote to memory of 3952 3580 70BB.tmp 97 PID 3580 wrote to memory of 3952 3580 70BB.tmp 97 PID 3952 wrote to memory of 388 3952 7196.tmp 98 PID 3952 wrote to memory of 388 3952 7196.tmp 98 PID 3952 wrote to memory of 388 3952 7196.tmp 98 PID 388 wrote to memory of 2460 388 7261.tmp 99 PID 388 wrote to memory of 2460 388 7261.tmp 99 PID 388 wrote to memory of 2460 388 7261.tmp 99 PID 2460 wrote to memory of 3148 2460 739A.tmp 100 PID 2460 wrote to memory of 3148 2460 739A.tmp 100 PID 2460 wrote to memory of 3148 2460 739A.tmp 100 PID 3148 wrote to memory of 3632 3148 7465.tmp 101 PID 3148 wrote to memory of 3632 3148 7465.tmp 101 PID 3148 wrote to memory of 3632 3148 7465.tmp 101 PID 3632 wrote to memory of 1448 3632 753F.tmp 102 PID 3632 wrote to memory of 1448 3632 753F.tmp 102 PID 3632 wrote to memory of 1448 3632 753F.tmp 102 PID 1448 wrote to memory of 2496 1448 75FB.tmp 103 PID 1448 wrote to memory of 2496 1448 75FB.tmp 103 PID 1448 wrote to memory of 2496 1448 75FB.tmp 103 PID 2496 wrote to memory of 1324 2496 7697.tmp 104 PID 2496 wrote to memory of 1324 2496 7697.tmp 104 PID 2496 wrote to memory of 1324 2496 7697.tmp 104 PID 1324 wrote to memory of 2268 1324 7714.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"23⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"24⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"25⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"26⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"27⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"28⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"29⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"30⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"31⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"32⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"33⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"34⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"35⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"36⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"37⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"38⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"39⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"40⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"41⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"42⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"43⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"44⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"45⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"46⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"47⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"48⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"49⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"50⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"51⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"52⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"53⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"54⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"55⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"56⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"57⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"58⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"59⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"60⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"61⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"62⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"63⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"64⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"65⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"66⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"67⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"68⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"69⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"70⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"71⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"72⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"73⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"74⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"75⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"76⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"77⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"78⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"79⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"80⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"81⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"82⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"83⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"84⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"85⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"86⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"87⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"88⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"89⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"90⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"91⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"92⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"93⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"94⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"95⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"96⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"97⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"98⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"99⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"100⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"101⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"102⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"103⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"104⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"105⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"106⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"107⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"108⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"109⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"110⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"111⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"112⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"113⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"114⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"115⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"116⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"117⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"118⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"119⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"120⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"121⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"122⤵PID:2932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-