Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 17:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-25_295fa4915bd7c531922b6906d67fc32b_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
General
-
Target
2024-01-25_295fa4915bd7c531922b6906d67fc32b_mafia.exe
-
Size
488KB
-
MD5
295fa4915bd7c531922b6906d67fc32b
-
SHA1
17437c849457be529126e94a94f935fac208ed15
-
SHA256
0574fce64ed1d600bfe7dc6912232f3c1e2681313bdfcbd22b6654c75b066cea
-
SHA512
03b37f97ad3c01d5a782b2cf1886d516a3728fb09788e507612475fb45d5c26ea7126e588e118d8cb1daf748b90b0df5ff45bef1e09c1ccbcf434abaeb93a621
-
SSDEEP
12288:/U5rCOTeiDZ4MnjyzgxuE9z0BU5oSwKqaisEllyNZ:/UQOJDZnjGwuPBU56Kq8YyN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4836 6D31.tmp 2588 6DBE.tmp 3620 6E4A.tmp 3332 6EE6.tmp 4932 6FA2.tmp 1336 702F.tmp 3164 70BB.tmp 3548 7119.tmp 3084 71B5.tmp 532 7242.tmp 3884 72AF.tmp 4900 732C.tmp 4664 73C8.tmp 4780 7455.tmp 5040 74C2.tmp 4696 75AD.tmp 768 7649.tmp 2612 76C6.tmp 3988 7753.tmp 4168 77C0.tmp 3688 781E.tmp 1604 789B.tmp 4744 7937.tmp 3096 79B4.tmp 2332 7A70.tmp 3408 7ADD.tmp 2304 7B98.tmp 3376 7CD1.tmp 1000 7D6D.tmp 3016 7E19.tmp 4428 7ED5.tmp 372 7F80.tmp 544 802C.tmp 4828 809A.tmp 3860 8107.tmp 4316 81D2.tmp 1744 826E.tmp 1508 831A.tmp 1424 83B7.tmp 4348 8453.tmp 2228 84DF.tmp 5104 857C.tmp 4560 85E9.tmp 2444 8695.tmp 4112 8722.tmp 3192 87CD.tmp 1516 885A.tmp 2760 88F6.tmp 4568 8973.tmp 1320 8A10.tmp 3164 8A9C.tmp 2780 8B29.tmp 1812 8BC5.tmp 4180 8C61.tmp 3040 8CEE.tmp 2496 8D9A.tmp 4792 8E17.tmp 4392 8EB3.tmp 1732 8F5F.tmp 3512 900B.tmp 620 90A7.tmp 3068 9134.tmp 4808 91B1.tmp 4140 923D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2132 wrote to memory of 4836 2132 2024-01-25_295fa4915bd7c531922b6906d67fc32b_mafia.exe 87 PID 2132 wrote to memory of 4836 2132 2024-01-25_295fa4915bd7c531922b6906d67fc32b_mafia.exe 87 PID 2132 wrote to memory of 4836 2132 2024-01-25_295fa4915bd7c531922b6906d67fc32b_mafia.exe 87 PID 4836 wrote to memory of 2588 4836 6D31.tmp 88 PID 4836 wrote to memory of 2588 4836 6D31.tmp 88 PID 4836 wrote to memory of 2588 4836 6D31.tmp 88 PID 2588 wrote to memory of 3620 2588 6DBE.tmp 89 PID 2588 wrote to memory of 3620 2588 6DBE.tmp 89 PID 2588 wrote to memory of 3620 2588 6DBE.tmp 89 PID 3620 wrote to memory of 3332 3620 6E4A.tmp 90 PID 3620 wrote to memory of 3332 3620 6E4A.tmp 90 PID 3620 wrote to memory of 3332 3620 6E4A.tmp 90 PID 3332 wrote to memory of 4932 3332 6EE6.tmp 92 PID 3332 wrote to memory of 4932 3332 6EE6.tmp 92 PID 3332 wrote to memory of 4932 3332 6EE6.tmp 92 PID 4932 wrote to memory of 1336 4932 6FA2.tmp 93 PID 4932 wrote to memory of 1336 4932 6FA2.tmp 93 PID 4932 wrote to memory of 1336 4932 6FA2.tmp 93 PID 1336 wrote to memory of 3164 1336 702F.tmp 94 PID 1336 wrote to memory of 3164 1336 702F.tmp 94 PID 1336 wrote to memory of 3164 1336 702F.tmp 94 PID 3164 wrote to memory of 3548 3164 70BB.tmp 95 PID 3164 wrote to memory of 3548 3164 70BB.tmp 95 PID 3164 wrote to memory of 3548 3164 70BB.tmp 95 PID 3548 wrote to memory of 3084 3548 7119.tmp 96 PID 3548 wrote to memory of 3084 3548 7119.tmp 96 PID 3548 wrote to memory of 3084 3548 7119.tmp 96 PID 3084 wrote to memory of 532 3084 71B5.tmp 97 PID 3084 wrote to memory of 532 3084 71B5.tmp 97 PID 3084 wrote to memory of 532 3084 71B5.tmp 97 PID 532 wrote to memory of 3884 532 7242.tmp 98 PID 532 wrote to memory of 3884 532 7242.tmp 98 PID 532 wrote to memory of 3884 532 7242.tmp 98 PID 3884 wrote to memory of 4900 3884 72AF.tmp 99 PID 3884 wrote to memory of 4900 3884 72AF.tmp 99 PID 3884 wrote to memory of 4900 3884 72AF.tmp 99 PID 4900 wrote to memory of 4664 4900 732C.tmp 100 PID 4900 wrote to memory of 4664 4900 732C.tmp 100 PID 4900 wrote to memory of 4664 4900 732C.tmp 100 PID 4664 wrote to memory of 4780 4664 73C8.tmp 101 PID 4664 wrote to memory of 4780 4664 73C8.tmp 101 PID 4664 wrote to memory of 4780 4664 73C8.tmp 101 PID 4780 wrote to memory of 5040 4780 7455.tmp 102 PID 4780 wrote to memory of 5040 4780 7455.tmp 102 PID 4780 wrote to memory of 5040 4780 7455.tmp 102 PID 5040 wrote to memory of 4696 5040 74C2.tmp 103 PID 5040 wrote to memory of 4696 5040 74C2.tmp 103 PID 5040 wrote to memory of 4696 5040 74C2.tmp 103 PID 4696 wrote to memory of 768 4696 75AD.tmp 104 PID 4696 wrote to memory of 768 4696 75AD.tmp 104 PID 4696 wrote to memory of 768 4696 75AD.tmp 104 PID 768 wrote to memory of 2612 768 7649.tmp 105 PID 768 wrote to memory of 2612 768 7649.tmp 105 PID 768 wrote to memory of 2612 768 7649.tmp 105 PID 2612 wrote to memory of 3988 2612 76C6.tmp 106 PID 2612 wrote to memory of 3988 2612 76C6.tmp 106 PID 2612 wrote to memory of 3988 2612 76C6.tmp 106 PID 3988 wrote to memory of 4168 3988 7753.tmp 107 PID 3988 wrote to memory of 4168 3988 7753.tmp 107 PID 3988 wrote to memory of 4168 3988 7753.tmp 107 PID 4168 wrote to memory of 3688 4168 77C0.tmp 108 PID 4168 wrote to memory of 3688 4168 77C0.tmp 108 PID 4168 wrote to memory of 3688 4168 77C0.tmp 108 PID 3688 wrote to memory of 1604 3688 781E.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_295fa4915bd7c531922b6906d67fc32b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_295fa4915bd7c531922b6906d67fc32b_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"23⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"24⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"25⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"26⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"27⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"28⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"29⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"30⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"31⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"32⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"33⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"34⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"35⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"36⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"37⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"38⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"39⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"40⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"41⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"42⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"43⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"44⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"45⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"46⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"47⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"48⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"49⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"50⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"51⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"52⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"53⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"54⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"55⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"56⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"57⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"58⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"59⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"60⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"61⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"62⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"63⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"64⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"65⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"66⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"67⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"68⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"69⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"70⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"71⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"72⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"73⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"74⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"75⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"76⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"77⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"78⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"79⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"80⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"81⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"82⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"83⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"84⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"85⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"86⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"87⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"88⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"89⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"90⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"91⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"92⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"93⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"94⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"95⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"96⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"97⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"98⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"99⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"100⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"101⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"102⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"103⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"104⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"105⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"106⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"107⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"108⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"109⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"110⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"111⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"112⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"113⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"114⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"115⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"116⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"117⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"118⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"119⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"120⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"121⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"122⤵PID:2712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-