Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 06:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-14_01ff9d37005216f11f747938700c1f3c_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-14_01ff9d37005216f11f747938700c1f3c_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-14_01ff9d37005216f11f747938700c1f3c_mafia.exe
-
Size
488KB
-
MD5
01ff9d37005216f11f747938700c1f3c
-
SHA1
34b4fa2030f2901a126794cbc4fc6af6a9e93956
-
SHA256
1a52d3bfcfd5066c14fdb9604bc05eaec07a6a8a1f154b8b4d87add34e418ebf
-
SHA512
1ccbbebb5a24937e1a474c6e24d939256d7cb884813fbb12737382b2e1850751c00f4553ab9a6d409a726f443a1b661a7c63a11d75a9a548ba6d26b1e3e0ddb7
-
SSDEEP
12288:/U5rCOTeiD5g6Agc8melK03CxjWqzR1O+suwtqbNZ:/UQOJD26ALelK03CxjNzDO+sXtqbN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3308 5350.tmp 884 53AE.tmp 1840 542B.tmp 1028 54A8.tmp 1444 5525.tmp 4500 5582.tmp 1912 55F0.tmp 2104 564E.tmp 4412 56BB.tmp 1064 5709.tmp 1388 5767.tmp 2552 57C5.tmp 3616 5822.tmp 4108 5870.tmp 3472 58CE.tmp 4256 593C.tmp 4072 598A.tmp 3348 59E7.tmp 2696 5A36.tmp 2132 5AA3.tmp 1504 5B10.tmp 3284 5B7E.tmp 4356 5BEB.tmp 4564 5C49.tmp 2876 5CC6.tmp 3272 5D24.tmp 720 5D72.tmp 4560 5DDF.tmp 2920 5E3D.tmp 5108 5E9B.tmp 4448 5EF8.tmp 2228 5F46.tmp 4304 5F95.tmp 2100 5FF2.tmp 4900 6050.tmp 1864 609E.tmp 2960 60EC.tmp 4888 613A.tmp 8 61C7.tmp 3228 6225.tmp 3720 6273.tmp 1564 62C1.tmp 1460 630F.tmp 5060 635D.tmp 2752 63BB.tmp 4544 6409.tmp 2380 6457.tmp 852 64B5.tmp 4972 6503.tmp 2000 6561.tmp 664 65AF.tmp 3728 65FD.tmp 3744 665B.tmp 3164 66B9.tmp 2284 6707.tmp 2852 6755.tmp 2512 67F1.tmp 3892 683F.tmp 3308 689D.tmp 736 68FB.tmp 2220 6949.tmp 1488 69A7.tmp 3140 69F5.tmp 460 6A53.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3984 wrote to memory of 3308 3984 2024-02-14_01ff9d37005216f11f747938700c1f3c_mafia.exe 84 PID 3984 wrote to memory of 3308 3984 2024-02-14_01ff9d37005216f11f747938700c1f3c_mafia.exe 84 PID 3984 wrote to memory of 3308 3984 2024-02-14_01ff9d37005216f11f747938700c1f3c_mafia.exe 84 PID 3308 wrote to memory of 884 3308 5350.tmp 85 PID 3308 wrote to memory of 884 3308 5350.tmp 85 PID 3308 wrote to memory of 884 3308 5350.tmp 85 PID 884 wrote to memory of 1840 884 53AE.tmp 86 PID 884 wrote to memory of 1840 884 53AE.tmp 86 PID 884 wrote to memory of 1840 884 53AE.tmp 86 PID 1840 wrote to memory of 1028 1840 542B.tmp 87 PID 1840 wrote to memory of 1028 1840 542B.tmp 87 PID 1840 wrote to memory of 1028 1840 542B.tmp 87 PID 1028 wrote to memory of 1444 1028 54A8.tmp 88 PID 1028 wrote to memory of 1444 1028 54A8.tmp 88 PID 1028 wrote to memory of 1444 1028 54A8.tmp 88 PID 1444 wrote to memory of 4500 1444 5525.tmp 89 PID 1444 wrote to memory of 4500 1444 5525.tmp 89 PID 1444 wrote to memory of 4500 1444 5525.tmp 89 PID 4500 wrote to memory of 1912 4500 5582.tmp 90 PID 4500 wrote to memory of 1912 4500 5582.tmp 90 PID 4500 wrote to memory of 1912 4500 5582.tmp 90 PID 1912 wrote to memory of 2104 1912 55F0.tmp 91 PID 1912 wrote to memory of 2104 1912 55F0.tmp 91 PID 1912 wrote to memory of 2104 1912 55F0.tmp 91 PID 2104 wrote to memory of 4412 2104 564E.tmp 92 PID 2104 wrote to memory of 4412 2104 564E.tmp 92 PID 2104 wrote to memory of 4412 2104 564E.tmp 92 PID 4412 wrote to memory of 1064 4412 56BB.tmp 93 PID 4412 wrote to memory of 1064 4412 56BB.tmp 93 PID 4412 wrote to memory of 1064 4412 56BB.tmp 93 PID 1064 wrote to memory of 1388 1064 5709.tmp 94 PID 1064 wrote to memory of 1388 1064 5709.tmp 94 PID 1064 wrote to memory of 1388 1064 5709.tmp 94 PID 1388 wrote to memory of 2552 1388 5767.tmp 95 PID 1388 wrote to memory of 2552 1388 5767.tmp 95 PID 1388 wrote to memory of 2552 1388 5767.tmp 95 PID 2552 wrote to memory of 3616 2552 57C5.tmp 96 PID 2552 wrote to memory of 3616 2552 57C5.tmp 96 PID 2552 wrote to memory of 3616 2552 57C5.tmp 96 PID 3616 wrote to memory of 4108 3616 5822.tmp 97 PID 3616 wrote to memory of 4108 3616 5822.tmp 97 PID 3616 wrote to memory of 4108 3616 5822.tmp 97 PID 4108 wrote to memory of 3472 4108 5870.tmp 98 PID 4108 wrote to memory of 3472 4108 5870.tmp 98 PID 4108 wrote to memory of 3472 4108 5870.tmp 98 PID 3472 wrote to memory of 4256 3472 58CE.tmp 99 PID 3472 wrote to memory of 4256 3472 58CE.tmp 99 PID 3472 wrote to memory of 4256 3472 58CE.tmp 99 PID 4256 wrote to memory of 4072 4256 593C.tmp 100 PID 4256 wrote to memory of 4072 4256 593C.tmp 100 PID 4256 wrote to memory of 4072 4256 593C.tmp 100 PID 4072 wrote to memory of 3348 4072 598A.tmp 101 PID 4072 wrote to memory of 3348 4072 598A.tmp 101 PID 4072 wrote to memory of 3348 4072 598A.tmp 101 PID 3348 wrote to memory of 2696 3348 59E7.tmp 102 PID 3348 wrote to memory of 2696 3348 59E7.tmp 102 PID 3348 wrote to memory of 2696 3348 59E7.tmp 102 PID 2696 wrote to memory of 2132 2696 5A36.tmp 103 PID 2696 wrote to memory of 2132 2696 5A36.tmp 103 PID 2696 wrote to memory of 2132 2696 5A36.tmp 103 PID 2132 wrote to memory of 1504 2132 5AA3.tmp 104 PID 2132 wrote to memory of 1504 2132 5AA3.tmp 104 PID 2132 wrote to memory of 1504 2132 5AA3.tmp 104 PID 1504 wrote to memory of 3284 1504 5B10.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_01ff9d37005216f11f747938700c1f3c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_01ff9d37005216f11f747938700c1f3c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"23⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"24⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"25⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"26⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"27⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"28⤵
- Executes dropped EXE
PID:720 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"29⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"30⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"31⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"32⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"33⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"34⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"35⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"36⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"37⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"38⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"39⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"40⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"41⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"42⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"43⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"44⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"45⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"46⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"47⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"48⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"49⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"50⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"51⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"52⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"53⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"54⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"55⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"56⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"57⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"58⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"59⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"60⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"61⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"62⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"63⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"64⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"65⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"66⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"67⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"68⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"69⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"70⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"71⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"72⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"73⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"74⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"75⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"76⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"77⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"78⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"79⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"80⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"81⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"82⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"83⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"84⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"85⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"86⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"87⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"88⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"89⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"90⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"91⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"92⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"93⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"94⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"95⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"96⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"97⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"98⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"99⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"100⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"101⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"102⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"103⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"104⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"105⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"106⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"107⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"108⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"109⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"110⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"111⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"112⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"113⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"114⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"115⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"116⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"117⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"118⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"119⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"120⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"121⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"122⤵PID:4764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-