Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/02/2024, 20:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-19_19907770b0cab6682bb2aa43bbc1e6a9_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-19_19907770b0cab6682bb2aa43bbc1e6a9_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-19_19907770b0cab6682bb2aa43bbc1e6a9_mafia.exe
-
Size
487KB
-
MD5
19907770b0cab6682bb2aa43bbc1e6a9
-
SHA1
54217c943253ea21a435f03bfb0d942918ea9b3c
-
SHA256
8f5310cc53dbe9c58740337bc74b2a14bb535b2b14435092ad8e10865c92879b
-
SHA512
d249a98345e59c184566f15a8ebc74719b3fc8d4927454a03deeea239f2f21c5c1ca97166b89480abc69b270f83e88d0b143400ba811a053202964fd0691a265
-
SSDEEP
12288:yU5rCOTeiNA3Jezm71tvWMSR3etp8+ybZ:yUQOJNAZeyBteME0eb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4344 C67C.tmp 2952 C7C4.tmp 4352 C870.tmp 1348 C96A.tmp 4556 CA35.tmp 2476 CAF1.tmp 3456 CBDB.tmp 1196 CCA6.tmp 2112 D5AF.tmp 1964 D63C.tmp 4488 D774.tmp 5060 D83F.tmp 3492 D939.tmp 1132 D9D5.tmp 3280 DB1E.tmp 2504 DC46.tmp 3312 DCF2.tmp 3136 DD9E.tmp 1896 DE79.tmp 4572 DF54.tmp 2424 E000.tmp 2924 E0CB.tmp 4392 E177.tmp 1648 E213.tmp 1888 E29F.tmp 3544 E36B.tmp 4592 E3F7.tmp 2416 E4A3.tmp 4492 E55F.tmp 3932 E5DC.tmp 3592 E687.tmp 4016 E704.tmp 4760 E7D0.tmp 4828 E86C.tmp 1012 E8E9.tmp 4180 EA31.tmp 2884 EAFC.tmp 3896 EBA8.tmp 3132 EC15.tmp 3068 ECF0.tmp 2056 ED7D.tmp 1728 EDEA.tmp 1296 EE77.tmp 3296 EF03.tmp 2444 EF71.tmp 3428 EFDE.tmp 4544 F06B.tmp 3596 F0E8.tmp 4972 F165.tmp 3500 F1E2.tmp 1764 F26E.tmp 1000 F2FB.tmp 3576 F378.tmp 3116 F3F5.tmp 460 F482.tmp 3152 F51E.tmp 2584 F57C.tmp 820 F5E9.tmp 4224 F676.tmp 4616 F721.tmp 3328 F78F.tmp 1032 F7ED.tmp 3360 F85A.tmp 3044 F8E7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1032 wrote to memory of 4344 1032 2024-02-19_19907770b0cab6682bb2aa43bbc1e6a9_mafia.exe 84 PID 1032 wrote to memory of 4344 1032 2024-02-19_19907770b0cab6682bb2aa43bbc1e6a9_mafia.exe 84 PID 1032 wrote to memory of 4344 1032 2024-02-19_19907770b0cab6682bb2aa43bbc1e6a9_mafia.exe 84 PID 4344 wrote to memory of 2952 4344 C67C.tmp 85 PID 4344 wrote to memory of 2952 4344 C67C.tmp 85 PID 4344 wrote to memory of 2952 4344 C67C.tmp 85 PID 2952 wrote to memory of 4352 2952 C7C4.tmp 86 PID 2952 wrote to memory of 4352 2952 C7C4.tmp 86 PID 2952 wrote to memory of 4352 2952 C7C4.tmp 86 PID 4352 wrote to memory of 1348 4352 C870.tmp 87 PID 4352 wrote to memory of 1348 4352 C870.tmp 87 PID 4352 wrote to memory of 1348 4352 C870.tmp 87 PID 1348 wrote to memory of 4556 1348 C96A.tmp 88 PID 1348 wrote to memory of 4556 1348 C96A.tmp 88 PID 1348 wrote to memory of 4556 1348 C96A.tmp 88 PID 4556 wrote to memory of 2476 4556 CA35.tmp 89 PID 4556 wrote to memory of 2476 4556 CA35.tmp 89 PID 4556 wrote to memory of 2476 4556 CA35.tmp 89 PID 2476 wrote to memory of 3456 2476 CAF1.tmp 90 PID 2476 wrote to memory of 3456 2476 CAF1.tmp 90 PID 2476 wrote to memory of 3456 2476 CAF1.tmp 90 PID 3456 wrote to memory of 1196 3456 CBDB.tmp 91 PID 3456 wrote to memory of 1196 3456 CBDB.tmp 91 PID 3456 wrote to memory of 1196 3456 CBDB.tmp 91 PID 1196 wrote to memory of 2112 1196 CCA6.tmp 92 PID 1196 wrote to memory of 2112 1196 CCA6.tmp 92 PID 1196 wrote to memory of 2112 1196 CCA6.tmp 92 PID 2112 wrote to memory of 1964 2112 D5AF.tmp 93 PID 2112 wrote to memory of 1964 2112 D5AF.tmp 93 PID 2112 wrote to memory of 1964 2112 D5AF.tmp 93 PID 1964 wrote to memory of 4488 1964 D63C.tmp 94 PID 1964 wrote to memory of 4488 1964 D63C.tmp 94 PID 1964 wrote to memory of 4488 1964 D63C.tmp 94 PID 4488 wrote to memory of 5060 4488 D774.tmp 95 PID 4488 wrote to memory of 5060 4488 D774.tmp 95 PID 4488 wrote to memory of 5060 4488 D774.tmp 95 PID 5060 wrote to memory of 3492 5060 D83F.tmp 96 PID 5060 wrote to memory of 3492 5060 D83F.tmp 96 PID 5060 wrote to memory of 3492 5060 D83F.tmp 96 PID 3492 wrote to memory of 1132 3492 D939.tmp 97 PID 3492 wrote to memory of 1132 3492 D939.tmp 97 PID 3492 wrote to memory of 1132 3492 D939.tmp 97 PID 1132 wrote to memory of 3280 1132 D9D5.tmp 98 PID 1132 wrote to memory of 3280 1132 D9D5.tmp 98 PID 1132 wrote to memory of 3280 1132 D9D5.tmp 98 PID 3280 wrote to memory of 2504 3280 DB1E.tmp 99 PID 3280 wrote to memory of 2504 3280 DB1E.tmp 99 PID 3280 wrote to memory of 2504 3280 DB1E.tmp 99 PID 2504 wrote to memory of 3312 2504 DC46.tmp 100 PID 2504 wrote to memory of 3312 2504 DC46.tmp 100 PID 2504 wrote to memory of 3312 2504 DC46.tmp 100 PID 3312 wrote to memory of 3136 3312 DCF2.tmp 101 PID 3312 wrote to memory of 3136 3312 DCF2.tmp 101 PID 3312 wrote to memory of 3136 3312 DCF2.tmp 101 PID 3136 wrote to memory of 1896 3136 DD9E.tmp 102 PID 3136 wrote to memory of 1896 3136 DD9E.tmp 102 PID 3136 wrote to memory of 1896 3136 DD9E.tmp 102 PID 1896 wrote to memory of 4572 1896 DE79.tmp 103 PID 1896 wrote to memory of 4572 1896 DE79.tmp 103 PID 1896 wrote to memory of 4572 1896 DE79.tmp 103 PID 4572 wrote to memory of 2424 4572 DF54.tmp 104 PID 4572 wrote to memory of 2424 4572 DF54.tmp 104 PID 4572 wrote to memory of 2424 4572 DF54.tmp 104 PID 2424 wrote to memory of 2924 2424 E000.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_19907770b0cab6682bb2aa43bbc1e6a9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_19907770b0cab6682bb2aa43bbc1e6a9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\C67C.tmp"C:\Users\Admin\AppData\Local\Temp\C67C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\C96A.tmp"C:\Users\Admin\AppData\Local\Temp\C96A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\CA35.tmp"C:\Users\Admin\AppData\Local\Temp\CA35.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\D63C.tmp"C:\Users\Admin\AppData\Local\Temp\D63C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\D774.tmp"C:\Users\Admin\AppData\Local\Temp\D774.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\D83F.tmp"C:\Users\Admin\AppData\Local\Temp\D83F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\DC46.tmp"C:\Users\Admin\AppData\Local\Temp\DC46.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\DE79.tmp"C:\Users\Admin\AppData\Local\Temp\DE79.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\E000.tmp"C:\Users\Admin\AppData\Local\Temp\E000.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"23⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"24⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\E213.tmp"C:\Users\Admin\AppData\Local\Temp\E213.tmp"25⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\E29F.tmp"C:\Users\Admin\AppData\Local\Temp\E29F.tmp"26⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"27⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"28⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"29⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"30⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"31⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\E687.tmp"C:\Users\Admin\AppData\Local\Temp\E687.tmp"32⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\E704.tmp"C:\Users\Admin\AppData\Local\Temp\E704.tmp"33⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"34⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"35⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"36⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\EA31.tmp"C:\Users\Admin\AppData\Local\Temp\EA31.tmp"37⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"38⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"39⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"40⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"41⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"42⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"43⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\EE77.tmp"C:\Users\Admin\AppData\Local\Temp\EE77.tmp"44⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\EF03.tmp"C:\Users\Admin\AppData\Local\Temp\EF03.tmp"45⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\EF71.tmp"C:\Users\Admin\AppData\Local\Temp\EF71.tmp"46⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"47⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\F06B.tmp"C:\Users\Admin\AppData\Local\Temp\F06B.tmp"48⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"49⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\F165.tmp"C:\Users\Admin\AppData\Local\Temp\F165.tmp"50⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"51⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\F26E.tmp"C:\Users\Admin\AppData\Local\Temp\F26E.tmp"52⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"53⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\F378.tmp"C:\Users\Admin\AppData\Local\Temp\F378.tmp"54⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"55⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"56⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\F51E.tmp"C:\Users\Admin\AppData\Local\Temp\F51E.tmp"57⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\F57C.tmp"C:\Users\Admin\AppData\Local\Temp\F57C.tmp"58⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"59⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"60⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"61⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"62⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"63⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\F85A.tmp"C:\Users\Admin\AppData\Local\Temp\F85A.tmp"64⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"65⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\F964.tmp"C:\Users\Admin\AppData\Local\Temp\F964.tmp"66⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"67⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"68⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"69⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"70⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"71⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\FC90.tmp"C:\Users\Admin\AppData\Local\Temp\FC90.tmp"72⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"73⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"74⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"75⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\FE94.tmp"C:\Users\Admin\AppData\Local\Temp\FE94.tmp"76⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"77⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"78⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"79⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"80⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\114.tmp"C:\Users\Admin\AppData\Local\Temp\114.tmp"81⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"82⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\20E.tmp"C:\Users\Admin\AppData\Local\Temp\20E.tmp"83⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"84⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"85⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"86⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"87⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"88⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"89⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"90⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"91⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\654.tmp"C:\Users\Admin\AppData\Local\Temp\654.tmp"92⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\6E1.tmp"C:\Users\Admin\AppData\Local\Temp\6E1.tmp"93⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\74E.tmp"C:\Users\Admin\AppData\Local\Temp\74E.tmp"94⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\7CB.tmp"C:\Users\Admin\AppData\Local\Temp\7CB.tmp"95⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"96⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"97⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"98⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\9EE.tmp"C:\Users\Admin\AppData\Local\Temp\9EE.tmp"99⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\A8A.tmp"C:\Users\Admin\AppData\Local\Temp\A8A.tmp"100⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"101⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\B75.tmp"C:\Users\Admin\AppData\Local\Temp\B75.tmp"102⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"103⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"104⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"105⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"106⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"107⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"108⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"109⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"110⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"111⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\1095.tmp"C:\Users\Admin\AppData\Local\Temp\1095.tmp"112⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\10F3.tmp"C:\Users\Admin\AppData\Local\Temp\10F3.tmp"113⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"114⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"115⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\12A8.tmp"C:\Users\Admin\AppData\Local\Temp\12A8.tmp"116⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\1325.tmp"C:\Users\Admin\AppData\Local\Temp\1325.tmp"117⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\1393.tmp"C:\Users\Admin\AppData\Local\Temp\1393.tmp"118⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"119⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\14DB.tmp"C:\Users\Admin\AppData\Local\Temp\14DB.tmp"120⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"121⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"122⤵PID:4872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-