Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
17/02/2024, 13:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-17_16f7144dd546050732d7f7601161db49_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-17_16f7144dd546050732d7f7601161db49_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-17_16f7144dd546050732d7f7601161db49_mafia.exe
-
Size
529KB
-
MD5
16f7144dd546050732d7f7601161db49
-
SHA1
98293e429355a6c124d19c8e93553ead39af6436
-
SHA256
15a4a6fac1d328f502f939fb3c6dbc3b987f28cfe5cabf2e786cbbf5286d7494
-
SHA512
771f7f87f6fc1eed015a799fe54e7ef0b7f63c948d1df62fced0df0bfb5901fac7dd9a26b5c65eb32a0620270b176f07db8b1a447bc01a65a1f7841c35afb7fc
-
SSDEEP
12288:NU5rCOTeijXWp5MPTWV6CPROH23XTZwlH4Hp:NUQOJjKqH2ROH2HTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1904 760B.tmp 5040 76F5.tmp 2296 77B0.tmp 1260 78CA.tmp 1384 7947.tmp 4200 79F3.tmp 4800 7ADD.tmp 3332 7B79.tmp 2916 7CD1.tmp 2812 7D8C.tmp 1064 7E77.tmp 4536 7F23.tmp 2392 7FFD.tmp 572 80A9.tmp 1848 81D2.tmp 1120 826E.tmp 2148 832A.tmp 1780 8414.tmp 4844 84B1.tmp 1804 853D.tmp 4652 8608.tmp 1292 86D3.tmp 2464 878F.tmp 2960 885A.tmp 4824 8935.tmp 1112 89E1.tmp 1928 8A6D.tmp 1912 8B48.tmp 3468 8C42.tmp 3728 8D1D.tmp 1984 8E07.tmp 2160 8EA3.tmp 4464 8F30.tmp 3264 8FAD.tmp 5060 902A.tmp 1304 90A7.tmp 4512 9124.tmp 848 91C0.tmp 996 923D.tmp 4316 92BA.tmp 3760 9347.tmp 4632 93B4.tmp 4636 9431.tmp 712 94BE.tmp 3564 953B.tmp 1936 95A8.tmp 5024 9664.tmp 3740 96E1.tmp 3364 975E.tmp 1556 97EA.tmp 1396 9858.tmp 4748 98D5.tmp 4408 9961.tmp 4012 9A6B.tmp 3140 9B07.tmp 2152 9B94.tmp 4504 9C21.tmp 3708 9C9E.tmp 5072 9CFB.tmp 956 9D59.tmp 1532 9DD6.tmp 1832 9E34.tmp 3964 9EA1.tmp 1712 9F1E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4236 wrote to memory of 1904 4236 2024-02-17_16f7144dd546050732d7f7601161db49_mafia.exe 83 PID 4236 wrote to memory of 1904 4236 2024-02-17_16f7144dd546050732d7f7601161db49_mafia.exe 83 PID 4236 wrote to memory of 1904 4236 2024-02-17_16f7144dd546050732d7f7601161db49_mafia.exe 83 PID 1904 wrote to memory of 5040 1904 760B.tmp 84 PID 1904 wrote to memory of 5040 1904 760B.tmp 84 PID 1904 wrote to memory of 5040 1904 760B.tmp 84 PID 5040 wrote to memory of 2296 5040 76F5.tmp 85 PID 5040 wrote to memory of 2296 5040 76F5.tmp 85 PID 5040 wrote to memory of 2296 5040 76F5.tmp 85 PID 2296 wrote to memory of 1260 2296 77B0.tmp 86 PID 2296 wrote to memory of 1260 2296 77B0.tmp 86 PID 2296 wrote to memory of 1260 2296 77B0.tmp 86 PID 1260 wrote to memory of 1384 1260 78CA.tmp 87 PID 1260 wrote to memory of 1384 1260 78CA.tmp 87 PID 1260 wrote to memory of 1384 1260 78CA.tmp 87 PID 1384 wrote to memory of 4200 1384 7947.tmp 88 PID 1384 wrote to memory of 4200 1384 7947.tmp 88 PID 1384 wrote to memory of 4200 1384 7947.tmp 88 PID 4200 wrote to memory of 4800 4200 79F3.tmp 89 PID 4200 wrote to memory of 4800 4200 79F3.tmp 89 PID 4200 wrote to memory of 4800 4200 79F3.tmp 89 PID 4800 wrote to memory of 3332 4800 7ADD.tmp 90 PID 4800 wrote to memory of 3332 4800 7ADD.tmp 90 PID 4800 wrote to memory of 3332 4800 7ADD.tmp 90 PID 3332 wrote to memory of 2916 3332 7B79.tmp 91 PID 3332 wrote to memory of 2916 3332 7B79.tmp 91 PID 3332 wrote to memory of 2916 3332 7B79.tmp 91 PID 2916 wrote to memory of 2812 2916 7CD1.tmp 92 PID 2916 wrote to memory of 2812 2916 7CD1.tmp 92 PID 2916 wrote to memory of 2812 2916 7CD1.tmp 92 PID 2812 wrote to memory of 1064 2812 7D8C.tmp 93 PID 2812 wrote to memory of 1064 2812 7D8C.tmp 93 PID 2812 wrote to memory of 1064 2812 7D8C.tmp 93 PID 1064 wrote to memory of 4536 1064 7E77.tmp 94 PID 1064 wrote to memory of 4536 1064 7E77.tmp 94 PID 1064 wrote to memory of 4536 1064 7E77.tmp 94 PID 4536 wrote to memory of 2392 4536 7F23.tmp 95 PID 4536 wrote to memory of 2392 4536 7F23.tmp 95 PID 4536 wrote to memory of 2392 4536 7F23.tmp 95 PID 2392 wrote to memory of 572 2392 7FFD.tmp 96 PID 2392 wrote to memory of 572 2392 7FFD.tmp 96 PID 2392 wrote to memory of 572 2392 7FFD.tmp 96 PID 572 wrote to memory of 1848 572 80A9.tmp 97 PID 572 wrote to memory of 1848 572 80A9.tmp 97 PID 572 wrote to memory of 1848 572 80A9.tmp 97 PID 1848 wrote to memory of 1120 1848 81D2.tmp 98 PID 1848 wrote to memory of 1120 1848 81D2.tmp 98 PID 1848 wrote to memory of 1120 1848 81D2.tmp 98 PID 1120 wrote to memory of 2148 1120 826E.tmp 99 PID 1120 wrote to memory of 2148 1120 826E.tmp 99 PID 1120 wrote to memory of 2148 1120 826E.tmp 99 PID 2148 wrote to memory of 1780 2148 832A.tmp 100 PID 2148 wrote to memory of 1780 2148 832A.tmp 100 PID 2148 wrote to memory of 1780 2148 832A.tmp 100 PID 1780 wrote to memory of 4844 1780 8414.tmp 101 PID 1780 wrote to memory of 4844 1780 8414.tmp 101 PID 1780 wrote to memory of 4844 1780 8414.tmp 101 PID 4844 wrote to memory of 1804 4844 84B1.tmp 102 PID 4844 wrote to memory of 1804 4844 84B1.tmp 102 PID 4844 wrote to memory of 1804 4844 84B1.tmp 102 PID 1804 wrote to memory of 4652 1804 853D.tmp 103 PID 1804 wrote to memory of 4652 1804 853D.tmp 103 PID 1804 wrote to memory of 4652 1804 853D.tmp 103 PID 4652 wrote to memory of 1292 4652 8608.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-17_16f7144dd546050732d7f7601161db49_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-17_16f7144dd546050732d7f7601161db49_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"23⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"24⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"25⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"26⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"27⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"28⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"29⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"30⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"31⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"32⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"33⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"34⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"35⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"36⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"37⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"38⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"39⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"40⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"41⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"42⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"43⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"44⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"45⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"46⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"47⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"48⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"49⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"50⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"51⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"52⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"53⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"54⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"55⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"56⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"57⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"58⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"59⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"60⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"61⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"62⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"63⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"64⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"65⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"66⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"67⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"68⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"69⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"70⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"71⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"72⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"73⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"74⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"75⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"76⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"77⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"78⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"79⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"80⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"81⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"82⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"83⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"84⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"85⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"86⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"87⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"88⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"89⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"90⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"91⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"92⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"93⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"94⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"95⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"96⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"97⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"98⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"99⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"100⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"101⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"102⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"103⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"104⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"105⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"106⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"107⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"108⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"109⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"110⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"111⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"112⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"113⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"114⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"115⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"116⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"117⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"118⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"119⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"120⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"121⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"122⤵PID:2416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-