Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24/02/2024, 00:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-24_bae3ec49214a05e9c3c47f850b665b9b_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-24_bae3ec49214a05e9c3c47f850b665b9b_mafia.exe
Resource
win10v2004-20240221-en
2 signatures
150 seconds
General
-
Target
2024-02-24_bae3ec49214a05e9c3c47f850b665b9b_mafia.exe
-
Size
487KB
-
MD5
bae3ec49214a05e9c3c47f850b665b9b
-
SHA1
b5e4b36c5742f280dad53eacd99e125c23a46e87
-
SHA256
49060cc7b37437900b049f1cff153b549d6958b9b02b38473f1090d09a06cca9
-
SHA512
5c09fa7bfe3c4442488e05d1b030d98dbb96623a6ab0c0a0e95e875e1270afd0904a0ad03f1831ff37f9bfbb7d16bedc16f7179cd79e97c6fa56c1eaa68b590c
-
SSDEEP
12288:HU5rCOTeiJbrBfiKZHkesbRqlcOBQCVuLNZ:HUQOJJbhiKFstqlfEN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 228 5E7B.tmp 2208 5FE3.tmp 4696 6050.tmp 1796 610C.tmp 3732 61A8.tmp 4760 6225.tmp 2160 62B1.tmp 4204 635D.tmp 4944 6438.tmp 5028 64E4.tmp 1660 65EE.tmp 4124 667A.tmp 2052 66F7.tmp 744 67A3.tmp 3768 6820.tmp 3916 68BC.tmp 2500 692A.tmp 1888 6A24.tmp 4844 6AD0.tmp 2812 6B6C.tmp 3624 6C47.tmp 4016 6D21.tmp 2824 6DAE.tmp 368 6E5A.tmp 3980 6EF6.tmp 4160 6FC1.tmp 4456 704E.tmp 1344 70DA.tmp 1808 71A6.tmp 4840 7261.tmp 1892 730D.tmp 760 739A.tmp 4900 7445.tmp 5008 74F1.tmp 1648 758E.tmp 4712 761A.tmp 3328 7697.tmp 4628 7714.tmp 1580 77C0.tmp 2656 784D.tmp 2240 7927.tmp 3576 79B4.tmp 2208 7A70.tmp 4400 7AFC.tmp 2784 7B98.tmp 1796 7C06.tmp 4328 7C73.tmp 4976 7D0F.tmp 4716 7D9C.tmp 3128 7E29.tmp 2160 7EE4.tmp 3868 7F80.tmp 3788 801D.tmp 1512 809A.tmp 4908 8107.tmp 3592 8184.tmp 4932 8201.tmp 4284 828E.tmp 2232 833A.tmp 3320 83D6.tmp 4816 8462.tmp 3900 84D0.tmp 1288 854D.tmp 2860 85CA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 228 1736 2024-02-24_bae3ec49214a05e9c3c47f850b665b9b_mafia.exe 87 PID 1736 wrote to memory of 228 1736 2024-02-24_bae3ec49214a05e9c3c47f850b665b9b_mafia.exe 87 PID 1736 wrote to memory of 228 1736 2024-02-24_bae3ec49214a05e9c3c47f850b665b9b_mafia.exe 87 PID 228 wrote to memory of 2208 228 5E7B.tmp 88 PID 228 wrote to memory of 2208 228 5E7B.tmp 88 PID 228 wrote to memory of 2208 228 5E7B.tmp 88 PID 2208 wrote to memory of 4696 2208 5FE3.tmp 89 PID 2208 wrote to memory of 4696 2208 5FE3.tmp 89 PID 2208 wrote to memory of 4696 2208 5FE3.tmp 89 PID 4696 wrote to memory of 1796 4696 6050.tmp 91 PID 4696 wrote to memory of 1796 4696 6050.tmp 91 PID 4696 wrote to memory of 1796 4696 6050.tmp 91 PID 1796 wrote to memory of 3732 1796 610C.tmp 92 PID 1796 wrote to memory of 3732 1796 610C.tmp 92 PID 1796 wrote to memory of 3732 1796 610C.tmp 92 PID 3732 wrote to memory of 4760 3732 61A8.tmp 93 PID 3732 wrote to memory of 4760 3732 61A8.tmp 93 PID 3732 wrote to memory of 4760 3732 61A8.tmp 93 PID 4760 wrote to memory of 2160 4760 6225.tmp 94 PID 4760 wrote to memory of 2160 4760 6225.tmp 94 PID 4760 wrote to memory of 2160 4760 6225.tmp 94 PID 2160 wrote to memory of 4204 2160 62B1.tmp 95 PID 2160 wrote to memory of 4204 2160 62B1.tmp 95 PID 2160 wrote to memory of 4204 2160 62B1.tmp 95 PID 4204 wrote to memory of 4944 4204 635D.tmp 96 PID 4204 wrote to memory of 4944 4204 635D.tmp 96 PID 4204 wrote to memory of 4944 4204 635D.tmp 96 PID 4944 wrote to memory of 5028 4944 6438.tmp 97 PID 4944 wrote to memory of 5028 4944 6438.tmp 97 PID 4944 wrote to memory of 5028 4944 6438.tmp 97 PID 5028 wrote to memory of 1660 5028 64E4.tmp 98 PID 5028 wrote to memory of 1660 5028 64E4.tmp 98 PID 5028 wrote to memory of 1660 5028 64E4.tmp 98 PID 1660 wrote to memory of 4124 1660 65EE.tmp 99 PID 1660 wrote to memory of 4124 1660 65EE.tmp 99 PID 1660 wrote to memory of 4124 1660 65EE.tmp 99 PID 4124 wrote to memory of 2052 4124 667A.tmp 100 PID 4124 wrote to memory of 2052 4124 667A.tmp 100 PID 4124 wrote to memory of 2052 4124 667A.tmp 100 PID 2052 wrote to memory of 744 2052 66F7.tmp 101 PID 2052 wrote to memory of 744 2052 66F7.tmp 101 PID 2052 wrote to memory of 744 2052 66F7.tmp 101 PID 744 wrote to memory of 3768 744 67A3.tmp 102 PID 744 wrote to memory of 3768 744 67A3.tmp 102 PID 744 wrote to memory of 3768 744 67A3.tmp 102 PID 3768 wrote to memory of 3916 3768 6820.tmp 103 PID 3768 wrote to memory of 3916 3768 6820.tmp 103 PID 3768 wrote to memory of 3916 3768 6820.tmp 103 PID 3916 wrote to memory of 2500 3916 68BC.tmp 104 PID 3916 wrote to memory of 2500 3916 68BC.tmp 104 PID 3916 wrote to memory of 2500 3916 68BC.tmp 104 PID 2500 wrote to memory of 1888 2500 692A.tmp 105 PID 2500 wrote to memory of 1888 2500 692A.tmp 105 PID 2500 wrote to memory of 1888 2500 692A.tmp 105 PID 1888 wrote to memory of 4844 1888 6A24.tmp 107 PID 1888 wrote to memory of 4844 1888 6A24.tmp 107 PID 1888 wrote to memory of 4844 1888 6A24.tmp 107 PID 4844 wrote to memory of 2812 4844 6AD0.tmp 108 PID 4844 wrote to memory of 2812 4844 6AD0.tmp 108 PID 4844 wrote to memory of 2812 4844 6AD0.tmp 108 PID 2812 wrote to memory of 3624 2812 6B6C.tmp 109 PID 2812 wrote to memory of 3624 2812 6B6C.tmp 109 PID 2812 wrote to memory of 3624 2812 6B6C.tmp 109 PID 3624 wrote to memory of 4016 3624 6C47.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-24_bae3ec49214a05e9c3c47f850b665b9b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-24_bae3ec49214a05e9c3c47f850b665b9b_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"23⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"24⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"25⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"26⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"27⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"28⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"29⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"30⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"31⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"32⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"33⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"34⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"35⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"36⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"37⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"38⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"39⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"40⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"41⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"42⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"43⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"44⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"45⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"46⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"47⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"48⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"49⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"50⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"51⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"52⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"53⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"54⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"55⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"56⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"57⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"58⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"59⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"60⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"61⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"62⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"63⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"64⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"65⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"66⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"67⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"68⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"69⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"70⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"71⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"72⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"73⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"74⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"75⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"76⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"77⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"78⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"79⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"80⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"81⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"82⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"83⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"84⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"85⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"86⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"87⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"88⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"89⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"90⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"91⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"92⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"93⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"94⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"95⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"96⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"97⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"98⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"99⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"100⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"101⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"102⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"103⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"104⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"105⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"106⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"107⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"108⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"109⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"110⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"111⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"112⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"113⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"114⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"115⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"116⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"117⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"118⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"119⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"120⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"121⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"122⤵PID:316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-