Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2024, 05:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-23_967e36a3526d7605ab49152549a54834_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-23_967e36a3526d7605ab49152549a54834_mafia.exe
Resource
win10v2004-20240221-en
2 signatures
150 seconds
General
-
Target
2024-02-23_967e36a3526d7605ab49152549a54834_mafia.exe
-
Size
488KB
-
MD5
967e36a3526d7605ab49152549a54834
-
SHA1
1b11caf63dc9d73a04158a42bf28e5f2458883b0
-
SHA256
3d650a32c47f5743181e021f5211d6c59c69589e86685a656731881a89d0a9aa
-
SHA512
4144a25e151feb64813860071bc8be0856ec2d5a5eb22348bfaad518e963f49021bd78efac6a84712db15aa38eaf8dc79d5b8a9620c17d29b5f34f7e2c207d53
-
SSDEEP
12288:/U5rCOTeiD0eQyOgIPSlAR/Gj8kV3txNZ:/UQOJDDdO1PhNGj/VdxN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4848 59B9.tmp 2828 5AA3.tmp 2068 5B8D.tmp 3892 5D24.tmp 1864 5DCF.tmp 4284 5EAA.tmp 3756 5F56.tmp 1972 5FE3.tmp 888 60AE.tmp 3288 614A.tmp 2448 61D7.tmp 2152 6263.tmp 2164 630F.tmp 4868 63EA.tmp 4960 6467.tmp 1964 6503.tmp 4900 65CE.tmp 1796 667A.tmp 3176 6716.tmp 1676 67A3.tmp 3136 683F.tmp 1696 68FB.tmp 4844 69B6.tmp 4540 6A72.tmp 2216 6B3D.tmp 1572 6C08.tmp 936 6CC4.tmp 3556 6D6F.tmp 3384 6E4A.tmp 3624 6F15.tmp 3356 6FD1.tmp 2308 70BB.tmp 536 7196.tmp 4448 7232.tmp 4388 72EE.tmp 3060 739A.tmp 5088 7445.tmp 2540 74E2.tmp 4264 758E.tmp 1560 762A.tmp 4036 76E5.tmp 3684 7791.tmp 2300 782D.tmp 1036 78BA.tmp 1432 7937.tmp 4580 79C4.tmp 4748 7A70.tmp 3648 7B79.tmp 3512 7BF6.tmp 3320 7C73.tmp 2188 7CF0.tmp 4284 7D8C.tmp 2112 7E09.tmp 1528 7EA6.tmp 4652 7F23.tmp 3392 7FCF.tmp 4892 806B.tmp 1916 8117.tmp 4116 81B3.tmp 2152 824F.tmp 3920 82FB.tmp 1360 83A7.tmp 2824 8443.tmp 3196 84C0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3252 wrote to memory of 4848 3252 2024-02-23_967e36a3526d7605ab49152549a54834_mafia.exe 87 PID 3252 wrote to memory of 4848 3252 2024-02-23_967e36a3526d7605ab49152549a54834_mafia.exe 87 PID 3252 wrote to memory of 4848 3252 2024-02-23_967e36a3526d7605ab49152549a54834_mafia.exe 87 PID 4848 wrote to memory of 2828 4848 59B9.tmp 89 PID 4848 wrote to memory of 2828 4848 59B9.tmp 89 PID 4848 wrote to memory of 2828 4848 59B9.tmp 89 PID 2828 wrote to memory of 2068 2828 5AA3.tmp 90 PID 2828 wrote to memory of 2068 2828 5AA3.tmp 90 PID 2828 wrote to memory of 2068 2828 5AA3.tmp 90 PID 2068 wrote to memory of 3892 2068 5B8D.tmp 92 PID 2068 wrote to memory of 3892 2068 5B8D.tmp 92 PID 2068 wrote to memory of 3892 2068 5B8D.tmp 92 PID 3892 wrote to memory of 1864 3892 5D24.tmp 93 PID 3892 wrote to memory of 1864 3892 5D24.tmp 93 PID 3892 wrote to memory of 1864 3892 5D24.tmp 93 PID 1864 wrote to memory of 4284 1864 5DCF.tmp 95 PID 1864 wrote to memory of 4284 1864 5DCF.tmp 95 PID 1864 wrote to memory of 4284 1864 5DCF.tmp 95 PID 4284 wrote to memory of 3756 4284 5EAA.tmp 96 PID 4284 wrote to memory of 3756 4284 5EAA.tmp 96 PID 4284 wrote to memory of 3756 4284 5EAA.tmp 96 PID 3756 wrote to memory of 1972 3756 5F56.tmp 97 PID 3756 wrote to memory of 1972 3756 5F56.tmp 97 PID 3756 wrote to memory of 1972 3756 5F56.tmp 97 PID 1972 wrote to memory of 888 1972 5FE3.tmp 98 PID 1972 wrote to memory of 888 1972 5FE3.tmp 98 PID 1972 wrote to memory of 888 1972 5FE3.tmp 98 PID 888 wrote to memory of 3288 888 60AE.tmp 99 PID 888 wrote to memory of 3288 888 60AE.tmp 99 PID 888 wrote to memory of 3288 888 60AE.tmp 99 PID 3288 wrote to memory of 2448 3288 614A.tmp 100 PID 3288 wrote to memory of 2448 3288 614A.tmp 100 PID 3288 wrote to memory of 2448 3288 614A.tmp 100 PID 2448 wrote to memory of 2152 2448 61D7.tmp 101 PID 2448 wrote to memory of 2152 2448 61D7.tmp 101 PID 2448 wrote to memory of 2152 2448 61D7.tmp 101 PID 2152 wrote to memory of 2164 2152 6263.tmp 102 PID 2152 wrote to memory of 2164 2152 6263.tmp 102 PID 2152 wrote to memory of 2164 2152 6263.tmp 102 PID 2164 wrote to memory of 4868 2164 630F.tmp 103 PID 2164 wrote to memory of 4868 2164 630F.tmp 103 PID 2164 wrote to memory of 4868 2164 630F.tmp 103 PID 4868 wrote to memory of 4960 4868 63EA.tmp 104 PID 4868 wrote to memory of 4960 4868 63EA.tmp 104 PID 4868 wrote to memory of 4960 4868 63EA.tmp 104 PID 4960 wrote to memory of 1964 4960 6467.tmp 106 PID 4960 wrote to memory of 1964 4960 6467.tmp 106 PID 4960 wrote to memory of 1964 4960 6467.tmp 106 PID 1964 wrote to memory of 4900 1964 6503.tmp 107 PID 1964 wrote to memory of 4900 1964 6503.tmp 107 PID 1964 wrote to memory of 4900 1964 6503.tmp 107 PID 4900 wrote to memory of 1796 4900 65CE.tmp 108 PID 4900 wrote to memory of 1796 4900 65CE.tmp 108 PID 4900 wrote to memory of 1796 4900 65CE.tmp 108 PID 1796 wrote to memory of 3176 1796 667A.tmp 109 PID 1796 wrote to memory of 3176 1796 667A.tmp 109 PID 1796 wrote to memory of 3176 1796 667A.tmp 109 PID 3176 wrote to memory of 1676 3176 6716.tmp 111 PID 3176 wrote to memory of 1676 3176 6716.tmp 111 PID 3176 wrote to memory of 1676 3176 6716.tmp 111 PID 1676 wrote to memory of 3136 1676 67A3.tmp 112 PID 1676 wrote to memory of 3136 1676 67A3.tmp 112 PID 1676 wrote to memory of 3136 1676 67A3.tmp 112 PID 3136 wrote to memory of 1696 3136 683F.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_967e36a3526d7605ab49152549a54834_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_967e36a3526d7605ab49152549a54834_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"23⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"24⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"25⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"26⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"27⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"28⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"29⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"30⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"31⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"32⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"33⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"34⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"35⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"36⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"37⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"38⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"39⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"40⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"41⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"42⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"43⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"44⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"45⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"46⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"47⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"48⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"49⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"50⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"51⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"52⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"53⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"54⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"55⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"56⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"57⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"58⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"59⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"60⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"61⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"62⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"63⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"64⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"65⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"66⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"67⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"68⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"69⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"70⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"71⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"72⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"73⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"74⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"75⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"76⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"77⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"78⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"79⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"80⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"81⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"82⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"83⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"84⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"85⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"86⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"87⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"88⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"89⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"90⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"91⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"92⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"93⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"94⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"95⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"96⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"97⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"98⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"99⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"100⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"101⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"102⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"103⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"104⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"105⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"106⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"107⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"108⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"109⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"110⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"111⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"112⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"113⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"114⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"115⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"116⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"117⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"118⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"119⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"120⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"121⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"122⤵PID:2164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-