Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2024, 10:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-23_ff3f0399cb93dc75037b5ba5f31afdca_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-23_ff3f0399cb93dc75037b5ba5f31afdca_mafia.exe
Resource
win10v2004-20240221-en
2 signatures
150 seconds
General
-
Target
2024-02-23_ff3f0399cb93dc75037b5ba5f31afdca_mafia.exe
-
Size
486KB
-
MD5
ff3f0399cb93dc75037b5ba5f31afdca
-
SHA1
222765717329611ba21785294f69be54d4135561
-
SHA256
823715ab09d56b12400a5c21eabe65b4629890ce751cb56fc0d7fb0c6320923d
-
SHA512
a07024f49501d4c9a9ec3082c59d2050dc52b8341c6e7702fbf73044f11a8ea3b91e8d6a97f499497bbb9e34605db672e833ea87b6980486c4b97f32ba626a07
-
SSDEEP
12288:/U5rCOTeiDH6vWYopOusHat9fx98HsMhBdkNZ:/UQOJDH6fyt1x98HnuN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3988 5842.tmp 4044 58ED.tmp 64 598A.tmp 4712 5A36.tmp 732 5B10.tmp 2812 5B8D.tmp 2480 5C39.tmp 3288 5CA7.tmp 2788 5D33.tmp 1516 5DC0.tmp 1340 5E6C.tmp 2096 606F.tmp 4700 60EC.tmp 1688 6189.tmp 1596 6244.tmp 4628 62F0.tmp 2348 63CB.tmp 5108 6486.tmp 2044 6561.tmp 1168 65FD.tmp 3588 668A.tmp 1700 6765.tmp 1932 683F.tmp 1764 68FB.tmp 3984 6978.tmp 4588 6A62.tmp 1152 6B0E.tmp 4000 6BBA.tmp 4048 6C66.tmp 1356 6CF2.tmp 2220 6D9E.tmp 4248 6E1B.tmp 3628 6EC7.tmp 1468 6F63.tmp 2100 6FE0.tmp 2928 706D.tmp 3224 70FA.tmp 1436 7167.tmp 3452 71F4.tmp 4440 7290.tmp 4404 730D.tmp 1636 737A.tmp 1624 73E8.tmp 3820 7474.tmp 4044 7501.tmp 4816 757E.tmp 1072 760B.tmp 4896 7697.tmp 4712 7705.tmp 3008 7782.tmp 1204 781E.tmp 3780 78CA.tmp 2724 7947.tmp 2520 79E3.tmp 3288 7A60.tmp 2376 7B0C.tmp 4892 7B79.tmp 1716 7BE7.tmp 3704 7C54.tmp 1928 7CD1.tmp 3712 7D3E.tmp 1344 7DDB.tmp 1688 7E58.tmp 1444 7ED5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3308 wrote to memory of 3988 3308 2024-02-23_ff3f0399cb93dc75037b5ba5f31afdca_mafia.exe 87 PID 3308 wrote to memory of 3988 3308 2024-02-23_ff3f0399cb93dc75037b5ba5f31afdca_mafia.exe 87 PID 3308 wrote to memory of 3988 3308 2024-02-23_ff3f0399cb93dc75037b5ba5f31afdca_mafia.exe 87 PID 3988 wrote to memory of 4044 3988 5842.tmp 89 PID 3988 wrote to memory of 4044 3988 5842.tmp 89 PID 3988 wrote to memory of 4044 3988 5842.tmp 89 PID 4044 wrote to memory of 64 4044 58ED.tmp 90 PID 4044 wrote to memory of 64 4044 58ED.tmp 90 PID 4044 wrote to memory of 64 4044 58ED.tmp 90 PID 64 wrote to memory of 4712 64 598A.tmp 91 PID 64 wrote to memory of 4712 64 598A.tmp 91 PID 64 wrote to memory of 4712 64 598A.tmp 91 PID 4712 wrote to memory of 732 4712 5A36.tmp 92 PID 4712 wrote to memory of 732 4712 5A36.tmp 92 PID 4712 wrote to memory of 732 4712 5A36.tmp 92 PID 732 wrote to memory of 2812 732 5B10.tmp 93 PID 732 wrote to memory of 2812 732 5B10.tmp 93 PID 732 wrote to memory of 2812 732 5B10.tmp 93 PID 2812 wrote to memory of 2480 2812 5B8D.tmp 94 PID 2812 wrote to memory of 2480 2812 5B8D.tmp 94 PID 2812 wrote to memory of 2480 2812 5B8D.tmp 94 PID 2480 wrote to memory of 3288 2480 5C39.tmp 95 PID 2480 wrote to memory of 3288 2480 5C39.tmp 95 PID 2480 wrote to memory of 3288 2480 5C39.tmp 95 PID 3288 wrote to memory of 2788 3288 5CA7.tmp 96 PID 3288 wrote to memory of 2788 3288 5CA7.tmp 96 PID 3288 wrote to memory of 2788 3288 5CA7.tmp 96 PID 2788 wrote to memory of 1516 2788 5D33.tmp 97 PID 2788 wrote to memory of 1516 2788 5D33.tmp 97 PID 2788 wrote to memory of 1516 2788 5D33.tmp 97 PID 1516 wrote to memory of 1340 1516 5DC0.tmp 98 PID 1516 wrote to memory of 1340 1516 5DC0.tmp 98 PID 1516 wrote to memory of 1340 1516 5DC0.tmp 98 PID 1340 wrote to memory of 2096 1340 5E6C.tmp 99 PID 1340 wrote to memory of 2096 1340 5E6C.tmp 99 PID 1340 wrote to memory of 2096 1340 5E6C.tmp 99 PID 2096 wrote to memory of 4700 2096 606F.tmp 100 PID 2096 wrote to memory of 4700 2096 606F.tmp 100 PID 2096 wrote to memory of 4700 2096 606F.tmp 100 PID 4700 wrote to memory of 1688 4700 60EC.tmp 101 PID 4700 wrote to memory of 1688 4700 60EC.tmp 101 PID 4700 wrote to memory of 1688 4700 60EC.tmp 101 PID 1688 wrote to memory of 1596 1688 6189.tmp 102 PID 1688 wrote to memory of 1596 1688 6189.tmp 102 PID 1688 wrote to memory of 1596 1688 6189.tmp 102 PID 1596 wrote to memory of 4628 1596 6244.tmp 103 PID 1596 wrote to memory of 4628 1596 6244.tmp 103 PID 1596 wrote to memory of 4628 1596 6244.tmp 103 PID 4628 wrote to memory of 2348 4628 62F0.tmp 104 PID 4628 wrote to memory of 2348 4628 62F0.tmp 104 PID 4628 wrote to memory of 2348 4628 62F0.tmp 104 PID 2348 wrote to memory of 5108 2348 63CB.tmp 105 PID 2348 wrote to memory of 5108 2348 63CB.tmp 105 PID 2348 wrote to memory of 5108 2348 63CB.tmp 105 PID 5108 wrote to memory of 2044 5108 6486.tmp 106 PID 5108 wrote to memory of 2044 5108 6486.tmp 106 PID 5108 wrote to memory of 2044 5108 6486.tmp 106 PID 2044 wrote to memory of 1168 2044 6561.tmp 107 PID 2044 wrote to memory of 1168 2044 6561.tmp 107 PID 2044 wrote to memory of 1168 2044 6561.tmp 107 PID 1168 wrote to memory of 3588 1168 65FD.tmp 108 PID 1168 wrote to memory of 3588 1168 65FD.tmp 108 PID 1168 wrote to memory of 3588 1168 65FD.tmp 108 PID 3588 wrote to memory of 1700 3588 668A.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_ff3f0399cb93dc75037b5ba5f31afdca_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_ff3f0399cb93dc75037b5ba5f31afdca_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"23⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"24⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"25⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"26⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"27⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"28⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"29⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"30⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"31⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"32⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"33⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"34⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"35⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"36⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"37⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"38⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"39⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"40⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"41⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"42⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"43⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"44⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"45⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"46⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"47⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"48⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"49⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"50⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"51⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"52⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"53⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"54⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"55⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"56⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"57⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"58⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"59⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"60⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"61⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"62⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"63⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"64⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"65⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"66⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"67⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"68⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"69⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"70⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"71⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"72⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"73⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"74⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"75⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"76⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\856C.tmp"C:\Users\Admin\AppData\Local\Temp\856C.tmp"77⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"78⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"79⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"80⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"81⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"82⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"83⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"84⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"85⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"86⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"87⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"88⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"89⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"90⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"91⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"92⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"93⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"94⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"95⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"96⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"97⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"98⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"99⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"100⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"101⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"102⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"103⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"104⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"105⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"106⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"107⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"108⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"109⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"110⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"111⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"112⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"113⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"114⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"115⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"116⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"117⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"118⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"119⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"120⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"121⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"122⤵PID:4700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-