Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 19:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-18_f601d77116a8ad9132bc65d8677da01c_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-18_f601d77116a8ad9132bc65d8677da01c_mafia.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-18_f601d77116a8ad9132bc65d8677da01c_mafia.exe
-
Size
536KB
-
MD5
f601d77116a8ad9132bc65d8677da01c
-
SHA1
6e2ebc7f4d56908213ebaa7fb6633ffb016dfcdc
-
SHA256
eaec95c8d376f13f634aedf39acf5a80ba2dbecb31454f175156c2d3e628e93f
-
SHA512
eecd24bda29b93aa53fc7f7d495a8d3d4b5ec7727ca5de99580199970520046072fe5a6a35991bcf05cb969ca7c805deb93a7ee9438ad9c4ec94f1ac4f655e7d
-
SSDEEP
12288:wU5rCOTeiU6Zqpue1HBza1U4IZxVJ0ZT9:wUQOJUHpueZRaXIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3200 D39C.tmp 4984 D4E4.tmp 3152 D5DE.tmp 3340 D6F7.tmp 3904 D820.tmp 1720 D968.tmp 2736 DA81.tmp 4692 DB8B.tmp 3968 DCC3.tmp 548 DDFC.tmp 4972 DEF6.tmp 4316 DFE0.tmp 4280 E119.tmp 5052 E232.tmp 4884 E35B.tmp 1996 E445.tmp 2868 E54F.tmp 208 E639.tmp 772 E714.tmp 3288 E81E.tmp 3060 E908.tmp 2480 E9E3.tmp 4796 EB0C.tmp 3936 EC06.tmp 1556 ED1F.tmp 4056 EE48.tmp 2932 EF51.tmp 820 F04B.tmp 3544 F145.tmp 1640 F211.tmp 4672 F30B.tmp 5112 F414.tmp 2232 F4B0.tmp 2316 F53D.tmp 404 F5AA.tmp 3376 F647.tmp 3796 F702.tmp 3604 F78F.tmp 3156 F7FC.tmp 2540 F86A.tmp 960 F8D7.tmp 3592 F954.tmp 2992 F9C1.tmp 2724 FA4E.tmp 216 FA9C.tmp 2252 FB38.tmp 564 FB96.tmp 2508 FC03.tmp 2000 FCDE.tmp 1548 FD4C.tmp 4932 FDA9.tmp 4168 FE26.tmp 1452 FEB3.tmp 1636 FF30.tmp 4828 FF8E.tmp 4860 B.tmp 1824 88.tmp 2496 F5.tmp 60 172.tmp 4632 1DF.tmp 1664 23D.tmp 1540 2AB.tmp 2748 328.tmp 732 385.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4772 wrote to memory of 3200 4772 2024-04-18_f601d77116a8ad9132bc65d8677da01c_mafia.exe 82 PID 4772 wrote to memory of 3200 4772 2024-04-18_f601d77116a8ad9132bc65d8677da01c_mafia.exe 82 PID 4772 wrote to memory of 3200 4772 2024-04-18_f601d77116a8ad9132bc65d8677da01c_mafia.exe 82 PID 3200 wrote to memory of 4984 3200 D39C.tmp 83 PID 3200 wrote to memory of 4984 3200 D39C.tmp 83 PID 3200 wrote to memory of 4984 3200 D39C.tmp 83 PID 4984 wrote to memory of 3152 4984 D4E4.tmp 85 PID 4984 wrote to memory of 3152 4984 D4E4.tmp 85 PID 4984 wrote to memory of 3152 4984 D4E4.tmp 85 PID 3152 wrote to memory of 3340 3152 D5DE.tmp 86 PID 3152 wrote to memory of 3340 3152 D5DE.tmp 86 PID 3152 wrote to memory of 3340 3152 D5DE.tmp 86 PID 3340 wrote to memory of 3904 3340 D6F7.tmp 87 PID 3340 wrote to memory of 3904 3340 D6F7.tmp 87 PID 3340 wrote to memory of 3904 3340 D6F7.tmp 87 PID 3904 wrote to memory of 1720 3904 D820.tmp 88 PID 3904 wrote to memory of 1720 3904 D820.tmp 88 PID 3904 wrote to memory of 1720 3904 D820.tmp 88 PID 1720 wrote to memory of 2736 1720 D968.tmp 89 PID 1720 wrote to memory of 2736 1720 D968.tmp 89 PID 1720 wrote to memory of 2736 1720 D968.tmp 89 PID 2736 wrote to memory of 4692 2736 DA81.tmp 90 PID 2736 wrote to memory of 4692 2736 DA81.tmp 90 PID 2736 wrote to memory of 4692 2736 DA81.tmp 90 PID 4692 wrote to memory of 3968 4692 DB8B.tmp 91 PID 4692 wrote to memory of 3968 4692 DB8B.tmp 91 PID 4692 wrote to memory of 3968 4692 DB8B.tmp 91 PID 3968 wrote to memory of 548 3968 DCC3.tmp 92 PID 3968 wrote to memory of 548 3968 DCC3.tmp 92 PID 3968 wrote to memory of 548 3968 DCC3.tmp 92 PID 548 wrote to memory of 4972 548 DDFC.tmp 93 PID 548 wrote to memory of 4972 548 DDFC.tmp 93 PID 548 wrote to memory of 4972 548 DDFC.tmp 93 PID 4972 wrote to memory of 4316 4972 DEF6.tmp 94 PID 4972 wrote to memory of 4316 4972 DEF6.tmp 94 PID 4972 wrote to memory of 4316 4972 DEF6.tmp 94 PID 4316 wrote to memory of 4280 4316 DFE0.tmp 95 PID 4316 wrote to memory of 4280 4316 DFE0.tmp 95 PID 4316 wrote to memory of 4280 4316 DFE0.tmp 95 PID 4280 wrote to memory of 5052 4280 E119.tmp 96 PID 4280 wrote to memory of 5052 4280 E119.tmp 96 PID 4280 wrote to memory of 5052 4280 E119.tmp 96 PID 5052 wrote to memory of 4884 5052 E232.tmp 97 PID 5052 wrote to memory of 4884 5052 E232.tmp 97 PID 5052 wrote to memory of 4884 5052 E232.tmp 97 PID 4884 wrote to memory of 1996 4884 E35B.tmp 98 PID 4884 wrote to memory of 1996 4884 E35B.tmp 98 PID 4884 wrote to memory of 1996 4884 E35B.tmp 98 PID 1996 wrote to memory of 2868 1996 E445.tmp 99 PID 1996 wrote to memory of 2868 1996 E445.tmp 99 PID 1996 wrote to memory of 2868 1996 E445.tmp 99 PID 2868 wrote to memory of 208 2868 E54F.tmp 100 PID 2868 wrote to memory of 208 2868 E54F.tmp 100 PID 2868 wrote to memory of 208 2868 E54F.tmp 100 PID 208 wrote to memory of 772 208 E639.tmp 101 PID 208 wrote to memory of 772 208 E639.tmp 101 PID 208 wrote to memory of 772 208 E639.tmp 101 PID 772 wrote to memory of 3288 772 E714.tmp 102 PID 772 wrote to memory of 3288 772 E714.tmp 102 PID 772 wrote to memory of 3288 772 E714.tmp 102 PID 3288 wrote to memory of 3060 3288 E81E.tmp 103 PID 3288 wrote to memory of 3060 3288 E81E.tmp 103 PID 3288 wrote to memory of 3060 3288 E81E.tmp 103 PID 3060 wrote to memory of 2480 3060 E908.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-18_f601d77116a8ad9132bc65d8677da01c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-18_f601d77116a8ad9132bc65d8677da01c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\D820.tmp"C:\Users\Admin\AppData\Local\Temp\D820.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\DA81.tmp"C:\Users\Admin\AppData\Local\Temp\DA81.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\E119.tmp"C:\Users\Admin\AppData\Local\Temp\E119.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\E445.tmp"C:\Users\Admin\AppData\Local\Temp\E445.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"23⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"24⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"25⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"26⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\EE48.tmp"C:\Users\Admin\AppData\Local\Temp\EE48.tmp"27⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"28⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\F04B.tmp"C:\Users\Admin\AppData\Local\Temp\F04B.tmp"29⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\F145.tmp"C:\Users\Admin\AppData\Local\Temp\F145.tmp"30⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"31⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\F30B.tmp"C:\Users\Admin\AppData\Local\Temp\F30B.tmp"32⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"33⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"34⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\F53D.tmp"C:\Users\Admin\AppData\Local\Temp\F53D.tmp"35⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"36⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\F647.tmp"C:\Users\Admin\AppData\Local\Temp\F647.tmp"37⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\F702.tmp"C:\Users\Admin\AppData\Local\Temp\F702.tmp"38⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"39⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"40⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"41⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"42⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\F954.tmp"C:\Users\Admin\AppData\Local\Temp\F954.tmp"43⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"44⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"45⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"46⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"47⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"48⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\FC03.tmp"C:\Users\Admin\AppData\Local\Temp\FC03.tmp"49⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\FC61.tmp"C:\Users\Admin\AppData\Local\Temp\FC61.tmp"50⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"51⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"52⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"53⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"54⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"55⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\FF30.tmp"C:\Users\Admin\AppData\Local\Temp\FF30.tmp"56⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"57⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"58⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\88.tmp"C:\Users\Admin\AppData\Local\Temp\88.tmp"59⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\F5.tmp"C:\Users\Admin\AppData\Local\Temp\F5.tmp"60⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"61⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\1DF.tmp"C:\Users\Admin\AppData\Local\Temp\1DF.tmp"62⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"63⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\2AB.tmp"C:\Users\Admin\AppData\Local\Temp\2AB.tmp"64⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"65⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"66⤵
- Executes dropped EXE
PID:732 -
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"67⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\470.tmp"C:\Users\Admin\AppData\Local\Temp\470.tmp"68⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\4BE.tmp"C:\Users\Admin\AppData\Local\Temp\4BE.tmp"69⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\53B.tmp"C:\Users\Admin\AppData\Local\Temp\53B.tmp"70⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"71⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"72⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\693.tmp"C:\Users\Admin\AppData\Local\Temp\693.tmp"73⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"74⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\76D.tmp"C:\Users\Admin\AppData\Local\Temp\76D.tmp"75⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"76⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"77⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\8B5.tmp"C:\Users\Admin\AppData\Local\Temp\8B5.tmp"78⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\932.tmp"C:\Users\Admin\AppData\Local\Temp\932.tmp"79⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"80⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\A0D.tmp"C:\Users\Admin\AppData\Local\Temp\A0D.tmp"81⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"82⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"83⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"84⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"85⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"86⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"87⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"88⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"89⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"90⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"91⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"92⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\FAB.tmp"C:\Users\Admin\AppData\Local\Temp\FAB.tmp"93⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\FF9.tmp"C:\Users\Admin\AppData\Local\Temp\FF9.tmp"94⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"95⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"96⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\1141.tmp"C:\Users\Admin\AppData\Local\Temp\1141.tmp"97⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"98⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"99⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\1289.tmp"C:\Users\Admin\AppData\Local\Temp\1289.tmp"100⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"101⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"102⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"103⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\143F.tmp"C:\Users\Admin\AppData\Local\Temp\143F.tmp"104⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"105⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\1539.tmp"C:\Users\Admin\AppData\Local\Temp\1539.tmp"106⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\1596.tmp"C:\Users\Admin\AppData\Local\Temp\1596.tmp"107⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"108⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\1671.tmp"C:\Users\Admin\AppData\Local\Temp\1671.tmp"109⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"110⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\176B.tmp"C:\Users\Admin\AppData\Local\Temp\176B.tmp"111⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"112⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"113⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\18C3.tmp"C:\Users\Admin\AppData\Local\Temp\18C3.tmp"114⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"115⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"116⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"117⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"118⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"119⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\1B43.tmp"C:\Users\Admin\AppData\Local\Temp\1B43.tmp"120⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"121⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"122⤵PID:2308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-