Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240220-en -
resource tags
arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system -
submitted
20-02-2024 13:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe
Resource
win10v2004-20240220-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe
-
Size
541KB
-
MD5
ec0f25182c3df9a6f025720ec972b40a
-
SHA1
c280f8977b4ef031e23a1f7a0f5f5f93924f4635
-
SHA256
8f06747dfa85cbef167100484c4f93d6f39572d23ce5b2e5880ac2da8e44cdbb
-
SHA512
4637aaa62d9fe5a94c3afa52b447b2ecfabf10f46a04324f44d08cec1a8a08c95bdf277948d8f8c79f99c36db65b7e4eec3c92454261a4dfa71728676701b0e8
-
SSDEEP
12288:UU5rCOTeifVfZ9B8mZkLgtNaTlKiZHbJeKsaoq2rZa73ctO:UUQOJfVjB8XculKiZ4hBfrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4588 4BDE.tmp 448 4C3B.tmp 1736 4C99.tmp 2032 4D16.tmp 3616 4D93.tmp 1536 4DF1.tmp 4312 4E5E.tmp 1404 4EDB.tmp 4780 4F39.tmp 3976 4F87.tmp 5024 4FE5.tmp 4060 5033.tmp 4752 5091.tmp 2808 50DF.tmp 4600 515C.tmp 2984 51AA.tmp 2484 5217.tmp 2568 5294.tmp 3968 52F2.tmp 1096 5350.tmp 4228 539E.tmp 3124 543A.tmp 1560 54B7.tmp 4200 5534.tmp 4900 55A2.tmp 4320 560F.tmp 2604 567C.tmp 3904 56EA.tmp 912 5738.tmp 2572 5796.tmp 4184 57E4.tmp 4592 5861.tmp 2440 58BF.tmp 1448 591C.tmp 1544 596A.tmp 3884 59C8.tmp 3356 5A16.tmp 4120 5A64.tmp 1144 5AC2.tmp 1392 5B20.tmp 2536 5B6E.tmp 4992 5BCC.tmp 2856 5C1A.tmp 3104 5C78.tmp 1476 5CC6.tmp 1292 5D24.tmp 3084 5D72.tmp 3988 5DCF.tmp 4300 5E1E.tmp 3088 5E6C.tmp 3780 5EBA.tmp 116 5F08.tmp 1252 5F56.tmp 3112 5FB4.tmp 4068 6002.tmp 448 6050.tmp 4372 60AE.tmp 1576 60FC.tmp 4924 614A.tmp 2932 61A8.tmp 2072 61F6.tmp 992 6254.tmp 548 62A2.tmp 1092 62F0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3824 wrote to memory of 4588 3824 2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe 85 PID 3824 wrote to memory of 4588 3824 2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe 85 PID 3824 wrote to memory of 4588 3824 2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe 85 PID 4588 wrote to memory of 448 4588 4BDE.tmp 86 PID 4588 wrote to memory of 448 4588 4BDE.tmp 86 PID 4588 wrote to memory of 448 4588 4BDE.tmp 86 PID 448 wrote to memory of 1736 448 4C3B.tmp 87 PID 448 wrote to memory of 1736 448 4C3B.tmp 87 PID 448 wrote to memory of 1736 448 4C3B.tmp 87 PID 1736 wrote to memory of 2032 1736 4C99.tmp 88 PID 1736 wrote to memory of 2032 1736 4C99.tmp 88 PID 1736 wrote to memory of 2032 1736 4C99.tmp 88 PID 2032 wrote to memory of 3616 2032 4D16.tmp 89 PID 2032 wrote to memory of 3616 2032 4D16.tmp 89 PID 2032 wrote to memory of 3616 2032 4D16.tmp 89 PID 3616 wrote to memory of 1536 3616 4D93.tmp 90 PID 3616 wrote to memory of 1536 3616 4D93.tmp 90 PID 3616 wrote to memory of 1536 3616 4D93.tmp 90 PID 1536 wrote to memory of 4312 1536 4DF1.tmp 91 PID 1536 wrote to memory of 4312 1536 4DF1.tmp 91 PID 1536 wrote to memory of 4312 1536 4DF1.tmp 91 PID 4312 wrote to memory of 1404 4312 4E5E.tmp 92 PID 4312 wrote to memory of 1404 4312 4E5E.tmp 92 PID 4312 wrote to memory of 1404 4312 4E5E.tmp 92 PID 1404 wrote to memory of 4780 1404 4EDB.tmp 93 PID 1404 wrote to memory of 4780 1404 4EDB.tmp 93 PID 1404 wrote to memory of 4780 1404 4EDB.tmp 93 PID 4780 wrote to memory of 3976 4780 4F39.tmp 94 PID 4780 wrote to memory of 3976 4780 4F39.tmp 94 PID 4780 wrote to memory of 3976 4780 4F39.tmp 94 PID 3976 wrote to memory of 5024 3976 4F87.tmp 95 PID 3976 wrote to memory of 5024 3976 4F87.tmp 95 PID 3976 wrote to memory of 5024 3976 4F87.tmp 95 PID 5024 wrote to memory of 4060 5024 4FE5.tmp 96 PID 5024 wrote to memory of 4060 5024 4FE5.tmp 96 PID 5024 wrote to memory of 4060 5024 4FE5.tmp 96 PID 4060 wrote to memory of 4752 4060 5033.tmp 97 PID 4060 wrote to memory of 4752 4060 5033.tmp 97 PID 4060 wrote to memory of 4752 4060 5033.tmp 97 PID 4752 wrote to memory of 2808 4752 5091.tmp 98 PID 4752 wrote to memory of 2808 4752 5091.tmp 98 PID 4752 wrote to memory of 2808 4752 5091.tmp 98 PID 2808 wrote to memory of 4600 2808 50DF.tmp 99 PID 2808 wrote to memory of 4600 2808 50DF.tmp 99 PID 2808 wrote to memory of 4600 2808 50DF.tmp 99 PID 4600 wrote to memory of 2984 4600 515C.tmp 100 PID 4600 wrote to memory of 2984 4600 515C.tmp 100 PID 4600 wrote to memory of 2984 4600 515C.tmp 100 PID 2984 wrote to memory of 2484 2984 51AA.tmp 101 PID 2984 wrote to memory of 2484 2984 51AA.tmp 101 PID 2984 wrote to memory of 2484 2984 51AA.tmp 101 PID 2484 wrote to memory of 2568 2484 5217.tmp 102 PID 2484 wrote to memory of 2568 2484 5217.tmp 102 PID 2484 wrote to memory of 2568 2484 5217.tmp 102 PID 2568 wrote to memory of 3968 2568 5294.tmp 103 PID 2568 wrote to memory of 3968 2568 5294.tmp 103 PID 2568 wrote to memory of 3968 2568 5294.tmp 103 PID 3968 wrote to memory of 1096 3968 52F2.tmp 104 PID 3968 wrote to memory of 1096 3968 52F2.tmp 104 PID 3968 wrote to memory of 1096 3968 52F2.tmp 104 PID 1096 wrote to memory of 4228 1096 5350.tmp 105 PID 1096 wrote to memory of 4228 1096 5350.tmp 105 PID 1096 wrote to memory of 4228 1096 5350.tmp 105 PID 4228 wrote to memory of 3124 4228 539E.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"23⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"24⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"25⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"26⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"27⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"28⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"29⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"30⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"31⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"32⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"33⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"34⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"35⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"36⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"37⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"38⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"39⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"40⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"41⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"42⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"43⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"44⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"45⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"46⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"47⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"48⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"49⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"50⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"51⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"52⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"53⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"54⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"55⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"56⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"57⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"58⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"59⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"60⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"61⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"62⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"63⤵
- Executes dropped EXE
PID:992 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"64⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"65⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"66⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"67⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"68⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"69⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"70⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"71⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"72⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"73⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"74⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"75⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"76⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"77⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"78⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"79⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"80⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"81⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"82⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"83⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"84⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"85⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"86⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"87⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"88⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"89⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"90⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"91⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"92⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"93⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"94⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"95⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"96⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"97⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"98⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"99⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"100⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"101⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"102⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"103⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"104⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"105⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"106⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"107⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"108⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"109⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"110⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"111⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"112⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"113⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"114⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"115⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"116⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"117⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"118⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"119⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"120⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"121⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"122⤵PID:1984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-