Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 16:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-31_eb3ae705bd9612846280696a44b2478f_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-31_eb3ae705bd9612846280696a44b2478f_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-31_eb3ae705bd9612846280696a44b2478f_mafia.exe
-
Size
520KB
-
MD5
eb3ae705bd9612846280696a44b2478f
-
SHA1
a61ee652243ce32ad5bff87324d7fafc4b5ef303
-
SHA256
09e67d887c29f6be720ff17ca5fbf2aae3079d67eabee44cfa65433bbc2d38fb
-
SHA512
ed96183cf2ceb4b3314d24367dc21791c8ab8666b5d402bfa737d2cab1b03a9416a2378e37fc412169e7835750f2cab0934cd3644c483522050b2e2b2e04b35a
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjL/lWThgDNIBFq8S8ZiK6SvEaD68ESKr1cz9GPF:roRXOQjmOyv3DoQ8PoKVxdEUJnoNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 768 FD1D.tmp 1624 FDC9.tmp 1700 FE26.tmp 3204 FEA3.tmp 872 FF20.tmp 2992 FF8E.tmp 4288 FFFB.tmp 4512 59.tmp 4188 D6.tmp 2212 134.tmp 2820 1A1.tmp 2280 1FF.tmp 4656 26C.tmp 2768 2F9.tmp 3388 366.tmp 1964 3C4.tmp 804 422.tmp 2332 47F.tmp 2108 50C.tmp 3188 579.tmp 3640 5D7.tmp 2364 664.tmp 5048 6F0.tmp 460 76D.tmp 4600 7BB.tmp 4584 819.tmp 4144 877.tmp 2844 8F4.tmp 1332 981.tmp 660 9EE.tmp 3052 A6B.tmp 632 AE8.tmp 740 B65.tmp 872 BB3.tmp 388 C01.tmp 1692 C4F.tmp 2992 C9D.tmp 3268 CEC.tmp 2924 D49.tmp 3800 DA7.tmp 1504 DF5.tmp 4456 E53.tmp 1540 EA1.tmp 956 EFF.tmp 4864 F4D.tmp 4692 F9B.tmp 3480 FE9.tmp 1924 1037.tmp 536 1085.tmp 1000 10D4.tmp 676 1131.tmp 2108 119F.tmp 3220 11FC.tmp 2364 124B.tmp 460 1299.tmp 4600 12E7.tmp 4380 1335.tmp 5064 1383.tmp 2360 13D1.tmp 2920 141F.tmp 2284 146D.tmp 672 14BC.tmp 2324 150A.tmp 552 1567.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1332 wrote to memory of 768 1332 2024-05-31_eb3ae705bd9612846280696a44b2478f_mafia.exe 90 PID 1332 wrote to memory of 768 1332 2024-05-31_eb3ae705bd9612846280696a44b2478f_mafia.exe 90 PID 1332 wrote to memory of 768 1332 2024-05-31_eb3ae705bd9612846280696a44b2478f_mafia.exe 90 PID 768 wrote to memory of 1624 768 FD1D.tmp 91 PID 768 wrote to memory of 1624 768 FD1D.tmp 91 PID 768 wrote to memory of 1624 768 FD1D.tmp 91 PID 1624 wrote to memory of 1700 1624 FDC9.tmp 92 PID 1624 wrote to memory of 1700 1624 FDC9.tmp 92 PID 1624 wrote to memory of 1700 1624 FDC9.tmp 92 PID 1700 wrote to memory of 3204 1700 FE26.tmp 93 PID 1700 wrote to memory of 3204 1700 FE26.tmp 93 PID 1700 wrote to memory of 3204 1700 FE26.tmp 93 PID 3204 wrote to memory of 872 3204 FEA3.tmp 95 PID 3204 wrote to memory of 872 3204 FEA3.tmp 95 PID 3204 wrote to memory of 872 3204 FEA3.tmp 95 PID 872 wrote to memory of 2992 872 FF20.tmp 96 PID 872 wrote to memory of 2992 872 FF20.tmp 96 PID 872 wrote to memory of 2992 872 FF20.tmp 96 PID 2992 wrote to memory of 4288 2992 FF8E.tmp 98 PID 2992 wrote to memory of 4288 2992 FF8E.tmp 98 PID 2992 wrote to memory of 4288 2992 FF8E.tmp 98 PID 4288 wrote to memory of 4512 4288 FFFB.tmp 99 PID 4288 wrote to memory of 4512 4288 FFFB.tmp 99 PID 4288 wrote to memory of 4512 4288 FFFB.tmp 99 PID 4512 wrote to memory of 4188 4512 59.tmp 101 PID 4512 wrote to memory of 4188 4512 59.tmp 101 PID 4512 wrote to memory of 4188 4512 59.tmp 101 PID 4188 wrote to memory of 2212 4188 D6.tmp 102 PID 4188 wrote to memory of 2212 4188 D6.tmp 102 PID 4188 wrote to memory of 2212 4188 D6.tmp 102 PID 2212 wrote to memory of 2820 2212 134.tmp 103 PID 2212 wrote to memory of 2820 2212 134.tmp 103 PID 2212 wrote to memory of 2820 2212 134.tmp 103 PID 2820 wrote to memory of 2280 2820 1A1.tmp 104 PID 2820 wrote to memory of 2280 2820 1A1.tmp 104 PID 2820 wrote to memory of 2280 2820 1A1.tmp 104 PID 2280 wrote to memory of 4656 2280 1FF.tmp 105 PID 2280 wrote to memory of 4656 2280 1FF.tmp 105 PID 2280 wrote to memory of 4656 2280 1FF.tmp 105 PID 4656 wrote to memory of 2768 4656 26C.tmp 106 PID 4656 wrote to memory of 2768 4656 26C.tmp 106 PID 4656 wrote to memory of 2768 4656 26C.tmp 106 PID 2768 wrote to memory of 3388 2768 2F9.tmp 107 PID 2768 wrote to memory of 3388 2768 2F9.tmp 107 PID 2768 wrote to memory of 3388 2768 2F9.tmp 107 PID 3388 wrote to memory of 1964 3388 366.tmp 108 PID 3388 wrote to memory of 1964 3388 366.tmp 108 PID 3388 wrote to memory of 1964 3388 366.tmp 108 PID 1964 wrote to memory of 804 1964 3C4.tmp 109 PID 1964 wrote to memory of 804 1964 3C4.tmp 109 PID 1964 wrote to memory of 804 1964 3C4.tmp 109 PID 804 wrote to memory of 2332 804 422.tmp 110 PID 804 wrote to memory of 2332 804 422.tmp 110 PID 804 wrote to memory of 2332 804 422.tmp 110 PID 2332 wrote to memory of 2108 2332 47F.tmp 111 PID 2332 wrote to memory of 2108 2332 47F.tmp 111 PID 2332 wrote to memory of 2108 2332 47F.tmp 111 PID 2108 wrote to memory of 3188 2108 50C.tmp 112 PID 2108 wrote to memory of 3188 2108 50C.tmp 112 PID 2108 wrote to memory of 3188 2108 50C.tmp 112 PID 3188 wrote to memory of 3640 3188 579.tmp 113 PID 3188 wrote to memory of 3640 3188 579.tmp 113 PID 3188 wrote to memory of 3640 3188 579.tmp 113 PID 3640 wrote to memory of 2364 3640 5D7.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_eb3ae705bd9612846280696a44b2478f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_eb3ae705bd9612846280696a44b2478f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\D6.tmp"C:\Users\Admin\AppData\Local\Temp\D6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\1A1.tmp"C:\Users\Admin\AppData\Local\Temp\1A1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\3C4.tmp"C:\Users\Admin\AppData\Local\Temp\3C4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\422.tmp"C:\Users\Admin\AppData\Local\Temp\422.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\579.tmp"C:\Users\Admin\AppData\Local\Temp\579.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"23⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"24⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\76D.tmp"C:\Users\Admin\AppData\Local\Temp\76D.tmp"25⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"26⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\819.tmp"C:\Users\Admin\AppData\Local\Temp\819.tmp"27⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"28⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\8F4.tmp"C:\Users\Admin\AppData\Local\Temp\8F4.tmp"29⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"30⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\9EE.tmp"C:\Users\Admin\AppData\Local\Temp\9EE.tmp"31⤵
- Executes dropped EXE
PID:660 -
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"32⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\AE8.tmp"C:\Users\Admin\AppData\Local\Temp\AE8.tmp"33⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\B65.tmp"C:\Users\Admin\AppData\Local\Temp\B65.tmp"34⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"35⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"36⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"37⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"38⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"39⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\D49.tmp"C:\Users\Admin\AppData\Local\Temp\D49.tmp"40⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"41⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"42⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"43⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"44⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\EFF.tmp"C:\Users\Admin\AppData\Local\Temp\EFF.tmp"45⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\F4D.tmp"C:\Users\Admin\AppData\Local\Temp\F4D.tmp"46⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"47⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"48⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"49⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\1085.tmp"C:\Users\Admin\AppData\Local\Temp\1085.tmp"50⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"51⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\1131.tmp"C:\Users\Admin\AppData\Local\Temp\1131.tmp"52⤵
- Executes dropped EXE
PID:676 -
C:\Users\Admin\AppData\Local\Temp\119F.tmp"C:\Users\Admin\AppData\Local\Temp\119F.tmp"53⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\11FC.tmp"C:\Users\Admin\AppData\Local\Temp\11FC.tmp"54⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"55⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"56⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"57⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"58⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\1383.tmp"C:\Users\Admin\AppData\Local\Temp\1383.tmp"59⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"60⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"61⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\146D.tmp"C:\Users\Admin\AppData\Local\Temp\146D.tmp"62⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"63⤵
- Executes dropped EXE
PID:672 -
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"64⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"65⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\15C5.tmp"C:\Users\Admin\AppData\Local\Temp\15C5.tmp"66⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"67⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"68⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"69⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"70⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\179A.tmp"C:\Users\Admin\AppData\Local\Temp\179A.tmp"71⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\17F8.tmp"C:\Users\Admin\AppData\Local\Temp\17F8.tmp"72⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\1855.tmp"C:\Users\Admin\AppData\Local\Temp\1855.tmp"73⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"74⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"75⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\194F.tmp"C:\Users\Admin\AppData\Local\Temp\194F.tmp"76⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"77⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\19EC.tmp"C:\Users\Admin\AppData\Local\Temp\19EC.tmp"78⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"79⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"80⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\1B05.tmp"C:\Users\Admin\AppData\Local\Temp\1B05.tmp"81⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"82⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"83⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"84⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"85⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"86⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"87⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\1D57.tmp"C:\Users\Admin\AppData\Local\Temp\1D57.tmp"88⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"89⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"90⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"91⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"92⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"93⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"94⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"95⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\2025.tmp"C:\Users\Admin\AppData\Local\Temp\2025.tmp"96⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"97⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"98⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\214E.tmp"C:\Users\Admin\AppData\Local\Temp\214E.tmp"99⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\21AC.tmp"C:\Users\Admin\AppData\Local\Temp\21AC.tmp"100⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\220A.tmp"C:\Users\Admin\AppData\Local\Temp\220A.tmp"101⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\2268.tmp"C:\Users\Admin\AppData\Local\Temp\2268.tmp"102⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"103⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"104⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\2381.tmp"C:\Users\Admin\AppData\Local\Temp\2381.tmp"105⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\23DF.tmp"C:\Users\Admin\AppData\Local\Temp\23DF.tmp"106⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\242D.tmp"C:\Users\Admin\AppData\Local\Temp\242D.tmp"107⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\247B.tmp"C:\Users\Admin\AppData\Local\Temp\247B.tmp"108⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"109⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\2517.tmp"C:\Users\Admin\AppData\Local\Temp\2517.tmp"110⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\2575.tmp"C:\Users\Admin\AppData\Local\Temp\2575.tmp"111⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"112⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"113⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\266F.tmp"C:\Users\Admin\AppData\Local\Temp\266F.tmp"114⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\26BD.tmp"C:\Users\Admin\AppData\Local\Temp\26BD.tmp"115⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\270B.tmp"C:\Users\Admin\AppData\Local\Temp\270B.tmp"116⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"117⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\27B7.tmp"C:\Users\Admin\AppData\Local\Temp\27B7.tmp"118⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2805.tmp"C:\Users\Admin\AppData\Local\Temp\2805.tmp"119⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\2863.tmp"C:\Users\Admin\AppData\Local\Temp\2863.tmp"120⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"121⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"122⤵PID:5016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-