Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 16:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-14_470f16889ea7901947013798f49fe3fc_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-14_470f16889ea7901947013798f49fe3fc_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-14_470f16889ea7901947013798f49fe3fc_mafia.exe
-
Size
536KB
-
MD5
470f16889ea7901947013798f49fe3fc
-
SHA1
ebbeaede9161722f5e362aa8255bdcb5314c8bd6
-
SHA256
f16cee12a8596ca0291d0f39137f6375eafa6e7b058d8b2c9ff42129e606203c
-
SHA512
cb0b0153dcf92fd97cc6fded2b28e3842dfa8e8eb7ded004b94bbfaade6b9e2d6e5f847b96f52b97f00b71c5deea86cc8e0f3f499942c9bbb39a66e087968099
-
SSDEEP
12288:wU5rCOTeiUAKkM47MPOjmoJtebwkIZxVJ0ZT9:wUQOJUAK+75JtebwkIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 116 7EF4.tmp 3592 801D.tmp 4508 8146.tmp 4484 824F.tmp 2644 8368.tmp 2984 8491.tmp 3828 85AB.tmp 3080 8906.tmp 1296 8A2F.tmp 3584 8F30.tmp 2128 902A.tmp 2500 9134.tmp 2412 926C.tmp 3088 9412.tmp 4868 950C.tmp 468 97DB.tmp 1288 9923.tmp 2208 9A1D.tmp 1632 9AE8.tmp 2592 9D98.tmp 2148 9E72.tmp 1648 9F9B.tmp 3416 A0B4.tmp 3276 A1AE.tmp 1956 A2B8.tmp 2460 A3E1.tmp 3568 A4BC.tmp 2620 A5B6.tmp 1512 A901.tmp 3128 A97E.tmp 3112 AAC7.tmp 4368 AD28.tmp 5008 AE12.tmp 1352 AE8F.tmp 112 AF1C.tmp 896 AF99.tmp 4412 B006.tmp 1304 B064.tmp 4792 B1DB.tmp 4944 B248.tmp 3220 B2B6.tmp 5040 B314.tmp 4164 B381.tmp 420 B3FE.tmp 2284 B47B.tmp 524 B4F8.tmp 4260 B565.tmp 1568 B73A.tmp 4744 B7B7.tmp 3660 B834.tmp 2500 B8B1.tmp 1124 B91E.tmp 3620 B99B.tmp 2920 BA47.tmp 1336 BAB5.tmp 460 BB12.tmp 3280 BC4B.tmp 2696 BCD8.tmp 3524 BD55.tmp 4360 BDB2.tmp 4844 BE2F.tmp 4152 BE9D.tmp 1764 BF1A.tmp 3136 BF97.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1280 wrote to memory of 116 1280 2024-02-14_470f16889ea7901947013798f49fe3fc_mafia.exe 84 PID 1280 wrote to memory of 116 1280 2024-02-14_470f16889ea7901947013798f49fe3fc_mafia.exe 84 PID 1280 wrote to memory of 116 1280 2024-02-14_470f16889ea7901947013798f49fe3fc_mafia.exe 84 PID 116 wrote to memory of 3592 116 7EF4.tmp 85 PID 116 wrote to memory of 3592 116 7EF4.tmp 85 PID 116 wrote to memory of 3592 116 7EF4.tmp 85 PID 3592 wrote to memory of 4508 3592 801D.tmp 86 PID 3592 wrote to memory of 4508 3592 801D.tmp 86 PID 3592 wrote to memory of 4508 3592 801D.tmp 86 PID 4508 wrote to memory of 4484 4508 8146.tmp 87 PID 4508 wrote to memory of 4484 4508 8146.tmp 87 PID 4508 wrote to memory of 4484 4508 8146.tmp 87 PID 4484 wrote to memory of 2644 4484 824F.tmp 88 PID 4484 wrote to memory of 2644 4484 824F.tmp 88 PID 4484 wrote to memory of 2644 4484 824F.tmp 88 PID 2644 wrote to memory of 2984 2644 8368.tmp 89 PID 2644 wrote to memory of 2984 2644 8368.tmp 89 PID 2644 wrote to memory of 2984 2644 8368.tmp 89 PID 2984 wrote to memory of 3828 2984 8491.tmp 90 PID 2984 wrote to memory of 3828 2984 8491.tmp 90 PID 2984 wrote to memory of 3828 2984 8491.tmp 90 PID 3828 wrote to memory of 3080 3828 85AB.tmp 91 PID 3828 wrote to memory of 3080 3828 85AB.tmp 91 PID 3828 wrote to memory of 3080 3828 85AB.tmp 91 PID 3080 wrote to memory of 1296 3080 8906.tmp 92 PID 3080 wrote to memory of 1296 3080 8906.tmp 92 PID 3080 wrote to memory of 1296 3080 8906.tmp 92 PID 1296 wrote to memory of 3584 1296 8A2F.tmp 93 PID 1296 wrote to memory of 3584 1296 8A2F.tmp 93 PID 1296 wrote to memory of 3584 1296 8A2F.tmp 93 PID 3584 wrote to memory of 2128 3584 8F30.tmp 94 PID 3584 wrote to memory of 2128 3584 8F30.tmp 94 PID 3584 wrote to memory of 2128 3584 8F30.tmp 94 PID 2128 wrote to memory of 2500 2128 902A.tmp 95 PID 2128 wrote to memory of 2500 2128 902A.tmp 95 PID 2128 wrote to memory of 2500 2128 902A.tmp 95 PID 2500 wrote to memory of 2412 2500 9134.tmp 96 PID 2500 wrote to memory of 2412 2500 9134.tmp 96 PID 2500 wrote to memory of 2412 2500 9134.tmp 96 PID 2412 wrote to memory of 3088 2412 926C.tmp 97 PID 2412 wrote to memory of 3088 2412 926C.tmp 97 PID 2412 wrote to memory of 3088 2412 926C.tmp 97 PID 3088 wrote to memory of 4868 3088 9412.tmp 98 PID 3088 wrote to memory of 4868 3088 9412.tmp 98 PID 3088 wrote to memory of 4868 3088 9412.tmp 98 PID 4868 wrote to memory of 468 4868 950C.tmp 99 PID 4868 wrote to memory of 468 4868 950C.tmp 99 PID 4868 wrote to memory of 468 4868 950C.tmp 99 PID 468 wrote to memory of 1288 468 97DB.tmp 100 PID 468 wrote to memory of 1288 468 97DB.tmp 100 PID 468 wrote to memory of 1288 468 97DB.tmp 100 PID 1288 wrote to memory of 2208 1288 9923.tmp 101 PID 1288 wrote to memory of 2208 1288 9923.tmp 101 PID 1288 wrote to memory of 2208 1288 9923.tmp 101 PID 2208 wrote to memory of 1632 2208 9A1D.tmp 102 PID 2208 wrote to memory of 1632 2208 9A1D.tmp 102 PID 2208 wrote to memory of 1632 2208 9A1D.tmp 102 PID 1632 wrote to memory of 2592 1632 9AE8.tmp 103 PID 1632 wrote to memory of 2592 1632 9AE8.tmp 103 PID 1632 wrote to memory of 2592 1632 9AE8.tmp 103 PID 2592 wrote to memory of 2148 2592 9D98.tmp 104 PID 2592 wrote to memory of 2148 2592 9D98.tmp 104 PID 2592 wrote to memory of 2148 2592 9D98.tmp 104 PID 2148 wrote to memory of 1648 2148 9E72.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_470f16889ea7901947013798f49fe3fc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_470f16889ea7901947013798f49fe3fc_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"23⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"24⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"25⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"26⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"27⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"28⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"29⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"30⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"31⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"32⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"33⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"34⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"35⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"36⤵
- Executes dropped EXE
PID:112 -
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"37⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"38⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"39⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"40⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"41⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"42⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"43⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"44⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"45⤵
- Executes dropped EXE
PID:420 -
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"46⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"47⤵
- Executes dropped EXE
PID:524 -
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"48⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"49⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"50⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"51⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"52⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"53⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"54⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"55⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"56⤵
- Executes dropped EXE
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"57⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"58⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"59⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"60⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"61⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"62⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"63⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"64⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"65⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"66⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"67⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"68⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"69⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"70⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"71⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"72⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"73⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"74⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\C582.tmp"C:\Users\Admin\AppData\Local\Temp\C582.tmp"75⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"76⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\C68C.tmp"C:\Users\Admin\AppData\Local\Temp\C68C.tmp"77⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"78⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"79⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"80⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"81⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"82⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"83⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"84⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"85⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"86⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"87⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"88⤵PID:420
-
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"89⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\CC58.tmp"C:\Users\Admin\AppData\Local\Temp\CC58.tmp"90⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"91⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\CD23.tmp"C:\Users\Admin\AppData\Local\Temp\CD23.tmp"92⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"93⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"94⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"95⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"96⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"97⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"98⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"99⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\D282.tmp"C:\Users\Admin\AppData\Local\Temp\D282.tmp"100⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\D32E.tmp"C:\Users\Admin\AppData\Local\Temp\D32E.tmp"101⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"102⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"103⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"104⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\D532.tmp"C:\Users\Admin\AppData\Local\Temp\D532.tmp"105⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"106⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\D61C.tmp"C:\Users\Admin\AppData\Local\Temp\D61C.tmp"107⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"108⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\D736.tmp"C:\Users\Admin\AppData\Local\Temp\D736.tmp"109⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"110⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\D830.tmp"C:\Users\Admin\AppData\Local\Temp\D830.tmp"111⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"112⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"113⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\D987.tmp"C:\Users\Admin\AppData\Local\Temp\D987.tmp"114⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"115⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"116⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"117⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"118⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"119⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\DC46.tmp"C:\Users\Admin\AppData\Local\Temp\DC46.tmp"120⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"121⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\DD31.tmp"C:\Users\Admin\AppData\Local\Temp\DD31.tmp"122⤵PID:4836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-