Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-02-2024 20:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe
-
Size
765KB
-
MD5
d093b66eda8e856ef353c4064eb5b4d2
-
SHA1
c03e04f7d16dbc6a71f31810fb5fbfc164e99e9e
-
SHA256
8318c7e2cb36ab80454671947b172c79836e5013ed95e635137efee8d93d24fe
-
SHA512
710ecc0a7384c30a804bdfdf20c318929af2a1f91e4011c7a4a3545b744367a5e5992a7aa00641a037e30185f0e2e3e2d567fb201d22136b8dbe9cc68e623ee9
-
SSDEEP
12288:ZU5rCOTeiDeoN1MxAiNdu6ibI7262fOX3ZF5rn5rLOa54U5w5A:ZUQOJDFN1M/vu6i8TX3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3516 83D6.tmp 4112 8482.tmp 2096 853D.tmp 4332 8628.tmp 4816 86E3.tmp 1792 87BE.tmp 4804 8889.tmp 4040 8935.tmp 1820 89E1.tmp 1460 8AFA.tmp 4452 8BA6.tmp 4984 8C90.tmp 1156 8D7B.tmp 4404 8E26.tmp 4808 8EF2.tmp 4536 8FEC.tmp 4164 9097.tmp 3548 9182.tmp 3252 92BA.tmp 1508 9366.tmp 2992 9402.tmp 4316 94FC.tmp 1044 95D7.tmp 3424 96F0.tmp 2744 97AC.tmp 3784 9887.tmp 1376 9933.tmp 3040 9A0D.tmp 888 9AF8.tmp 4936 9BC3.tmp 3316 9C7E.tmp 2872 9D3A.tmp 4768 9E15.tmp 1484 9EA1.tmp 4860 9F1E.tmp 3876 9FBA.tmp 2876 A047.tmp 1520 A0E3.tmp 3032 A160.tmp 1748 A1DD.tmp 552 A25A.tmp 3512 A3C2.tmp 1028 A43F.tmp 364 A4DB.tmp 1948 A577.tmp 3604 A613.tmp 2372 A6BF.tmp 2504 A75C.tmp 1688 A7D9.tmp 2464 A856.tmp 5104 A8D3.tmp 3520 A940.tmp 3244 A9AD.tmp 4748 AA1B.tmp 1104 AAC7.tmp 1388 AB34.tmp 4180 AB92.tmp 1792 AC3E.tmp 4988 AC9B.tmp 3928 AD09.tmp 864 ADB5.tmp 1172 AE32.tmp 1196 AEAF.tmp 3684 AF0C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4336 wrote to memory of 3516 4336 2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe 82 PID 4336 wrote to memory of 3516 4336 2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe 82 PID 4336 wrote to memory of 3516 4336 2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe 82 PID 3516 wrote to memory of 4112 3516 83D6.tmp 83 PID 3516 wrote to memory of 4112 3516 83D6.tmp 83 PID 3516 wrote to memory of 4112 3516 83D6.tmp 83 PID 4112 wrote to memory of 2096 4112 8482.tmp 84 PID 4112 wrote to memory of 2096 4112 8482.tmp 84 PID 4112 wrote to memory of 2096 4112 8482.tmp 84 PID 2096 wrote to memory of 4332 2096 853D.tmp 85 PID 2096 wrote to memory of 4332 2096 853D.tmp 85 PID 2096 wrote to memory of 4332 2096 853D.tmp 85 PID 4332 wrote to memory of 4816 4332 8628.tmp 86 PID 4332 wrote to memory of 4816 4332 8628.tmp 86 PID 4332 wrote to memory of 4816 4332 8628.tmp 86 PID 4816 wrote to memory of 1792 4816 86E3.tmp 87 PID 4816 wrote to memory of 1792 4816 86E3.tmp 87 PID 4816 wrote to memory of 1792 4816 86E3.tmp 87 PID 1792 wrote to memory of 4804 1792 87BE.tmp 88 PID 1792 wrote to memory of 4804 1792 87BE.tmp 88 PID 1792 wrote to memory of 4804 1792 87BE.tmp 88 PID 4804 wrote to memory of 4040 4804 8889.tmp 89 PID 4804 wrote to memory of 4040 4804 8889.tmp 89 PID 4804 wrote to memory of 4040 4804 8889.tmp 89 PID 4040 wrote to memory of 1820 4040 8935.tmp 90 PID 4040 wrote to memory of 1820 4040 8935.tmp 90 PID 4040 wrote to memory of 1820 4040 8935.tmp 90 PID 1820 wrote to memory of 1460 1820 89E1.tmp 91 PID 1820 wrote to memory of 1460 1820 89E1.tmp 91 PID 1820 wrote to memory of 1460 1820 89E1.tmp 91 PID 1460 wrote to memory of 4452 1460 8AFA.tmp 92 PID 1460 wrote to memory of 4452 1460 8AFA.tmp 92 PID 1460 wrote to memory of 4452 1460 8AFA.tmp 92 PID 4452 wrote to memory of 4984 4452 8BA6.tmp 93 PID 4452 wrote to memory of 4984 4452 8BA6.tmp 93 PID 4452 wrote to memory of 4984 4452 8BA6.tmp 93 PID 4984 wrote to memory of 1156 4984 8C90.tmp 94 PID 4984 wrote to memory of 1156 4984 8C90.tmp 94 PID 4984 wrote to memory of 1156 4984 8C90.tmp 94 PID 1156 wrote to memory of 4404 1156 8D7B.tmp 95 PID 1156 wrote to memory of 4404 1156 8D7B.tmp 95 PID 1156 wrote to memory of 4404 1156 8D7B.tmp 95 PID 4404 wrote to memory of 4808 4404 8E26.tmp 96 PID 4404 wrote to memory of 4808 4404 8E26.tmp 96 PID 4404 wrote to memory of 4808 4404 8E26.tmp 96 PID 4808 wrote to memory of 4536 4808 8EF2.tmp 97 PID 4808 wrote to memory of 4536 4808 8EF2.tmp 97 PID 4808 wrote to memory of 4536 4808 8EF2.tmp 97 PID 4536 wrote to memory of 4164 4536 8FEC.tmp 98 PID 4536 wrote to memory of 4164 4536 8FEC.tmp 98 PID 4536 wrote to memory of 4164 4536 8FEC.tmp 98 PID 4164 wrote to memory of 3548 4164 9097.tmp 99 PID 4164 wrote to memory of 3548 4164 9097.tmp 99 PID 4164 wrote to memory of 3548 4164 9097.tmp 99 PID 3548 wrote to memory of 3252 3548 9182.tmp 100 PID 3548 wrote to memory of 3252 3548 9182.tmp 100 PID 3548 wrote to memory of 3252 3548 9182.tmp 100 PID 3252 wrote to memory of 1508 3252 92BA.tmp 101 PID 3252 wrote to memory of 1508 3252 92BA.tmp 101 PID 3252 wrote to memory of 1508 3252 92BA.tmp 101 PID 1508 wrote to memory of 2992 1508 9366.tmp 102 PID 1508 wrote to memory of 2992 1508 9366.tmp 102 PID 1508 wrote to memory of 2992 1508 9366.tmp 102 PID 2992 wrote to memory of 4316 2992 9402.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"23⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"24⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"25⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"26⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"27⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"28⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"29⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"30⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"31⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"32⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"33⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"34⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"35⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"36⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"37⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"38⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"39⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"40⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"41⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"42⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"43⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"44⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"45⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"46⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"47⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"48⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"49⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"50⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"51⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"52⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"53⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"54⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"55⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"56⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"57⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"58⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"59⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"60⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"61⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"62⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"63⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"64⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"65⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"66⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"67⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"68⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"69⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"70⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"71⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"72⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"73⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"74⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"75⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"76⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"77⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"78⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"79⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"80⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"81⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"82⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"83⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"84⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"85⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"86⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"87⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"88⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"89⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"90⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"91⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"92⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"93⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"94⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"95⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"96⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"97⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"98⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"99⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"100⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"101⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"102⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"103⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"104⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"105⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"106⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"107⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"108⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"109⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"110⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"111⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"112⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"113⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"114⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"115⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"116⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\CA64.tmp"C:\Users\Admin\AppData\Local\Temp\CA64.tmp"117⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"118⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"119⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"120⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"121⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\CD04.tmp"C:\Users\Admin\AppData\Local\Temp\CD04.tmp"122⤵PID:3084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-