Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 17:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-26_b7e9e492d2ebb928b252d16fbb64f301_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-26_b7e9e492d2ebb928b252d16fbb64f301_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-01-26_b7e9e492d2ebb928b252d16fbb64f301_mafia.exe
-
Size
486KB
-
MD5
b7e9e492d2ebb928b252d16fbb64f301
-
SHA1
54fd370c974f5707f1a7209a06533c424c4cdac9
-
SHA256
36db7509b16f95db3ccc98a8e32fe92bfa0f800142f7aa3604f74f6546c640c5
-
SHA512
24f42dcb4c2cd39e9ff916857168ff2b5575c5db699292c11010f5edb906b742ebd94c153e83dd030a870f4a50367e13268c8e6ef16a8588c5ebadab1d162900
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7xBZvEbHzT8pjhWhvXwhQKMTWVxiM8FnZ+0hp:/U5rCOTeiDxBZMbHvM8gi1qGc0cmnNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1580 7659.tmp 3988 7705.tmp 2452 77B0.tmp 392 787C.tmp 2204 7927.tmp 2188 79A4.tmp 2964 7A31.tmp 4048 7AAE.tmp 1996 7B4A.tmp 2972 7BE7.tmp 3736 7CA2.tmp 3116 7D5E.tmp 4888 7DFA.tmp 568 7E96.tmp 2352 7F42.tmp 2060 806B.tmp 3616 80F7.tmp 1216 81C3.tmp 5048 828E.tmp 3868 8349.tmp 420 83B7.tmp 3696 8443.tmp 2012 850E.tmp 3640 85BA.tmp 4932 8637.tmp 4680 86B4.tmp 836 8760.tmp 3760 880C.tmp 1704 88E7.tmp 4796 8954.tmp 2892 8A10.tmp 2408 8B0A.tmp 1380 8BF4.tmp 1116 8CA0.tmp 4348 8D2C.tmp 1628 8DA9.tmp 2676 8E36.tmp 212 8ED2.tmp 2196 8F6F.tmp 3108 8FDC.tmp 4620 90A7.tmp 2240 9153.tmp 3552 91FF.tmp 856 928B.tmp 2188 9318.tmp 3224 93A5.tmp 4548 9422.tmp 4936 94BE.tmp 236 956A.tmp 4312 9616.tmp 1112 96A2.tmp 3736 974E.tmp 3116 97DB.tmp 1228 9887.tmp 2260 9942.tmp 4684 99CF.tmp 2352 9A5B.tmp 4980 9AD8.tmp 1140 9B46.tmp 1724 9BB3.tmp 4136 9C4F.tmp 968 9CDC.tmp 436 9D59.tmp 1152 9DE6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2376 wrote to memory of 1580 2376 2024-01-26_b7e9e492d2ebb928b252d16fbb64f301_mafia.exe 87 PID 2376 wrote to memory of 1580 2376 2024-01-26_b7e9e492d2ebb928b252d16fbb64f301_mafia.exe 87 PID 2376 wrote to memory of 1580 2376 2024-01-26_b7e9e492d2ebb928b252d16fbb64f301_mafia.exe 87 PID 1580 wrote to memory of 3988 1580 7659.tmp 88 PID 1580 wrote to memory of 3988 1580 7659.tmp 88 PID 1580 wrote to memory of 3988 1580 7659.tmp 88 PID 3988 wrote to memory of 2452 3988 7705.tmp 90 PID 3988 wrote to memory of 2452 3988 7705.tmp 90 PID 3988 wrote to memory of 2452 3988 7705.tmp 90 PID 2452 wrote to memory of 392 2452 77B0.tmp 91 PID 2452 wrote to memory of 392 2452 77B0.tmp 91 PID 2452 wrote to memory of 392 2452 77B0.tmp 91 PID 392 wrote to memory of 2204 392 787C.tmp 92 PID 392 wrote to memory of 2204 392 787C.tmp 92 PID 392 wrote to memory of 2204 392 787C.tmp 92 PID 2204 wrote to memory of 2188 2204 7927.tmp 93 PID 2204 wrote to memory of 2188 2204 7927.tmp 93 PID 2204 wrote to memory of 2188 2204 7927.tmp 93 PID 2188 wrote to memory of 2964 2188 79A4.tmp 94 PID 2188 wrote to memory of 2964 2188 79A4.tmp 94 PID 2188 wrote to memory of 2964 2188 79A4.tmp 94 PID 2964 wrote to memory of 4048 2964 7A31.tmp 95 PID 2964 wrote to memory of 4048 2964 7A31.tmp 95 PID 2964 wrote to memory of 4048 2964 7A31.tmp 95 PID 4048 wrote to memory of 1996 4048 7AAE.tmp 96 PID 4048 wrote to memory of 1996 4048 7AAE.tmp 96 PID 4048 wrote to memory of 1996 4048 7AAE.tmp 96 PID 1996 wrote to memory of 2972 1996 7B4A.tmp 97 PID 1996 wrote to memory of 2972 1996 7B4A.tmp 97 PID 1996 wrote to memory of 2972 1996 7B4A.tmp 97 PID 2972 wrote to memory of 3736 2972 7BE7.tmp 98 PID 2972 wrote to memory of 3736 2972 7BE7.tmp 98 PID 2972 wrote to memory of 3736 2972 7BE7.tmp 98 PID 3736 wrote to memory of 3116 3736 7CA2.tmp 99 PID 3736 wrote to memory of 3116 3736 7CA2.tmp 99 PID 3736 wrote to memory of 3116 3736 7CA2.tmp 99 PID 3116 wrote to memory of 4888 3116 7D5E.tmp 100 PID 3116 wrote to memory of 4888 3116 7D5E.tmp 100 PID 3116 wrote to memory of 4888 3116 7D5E.tmp 100 PID 4888 wrote to memory of 568 4888 7DFA.tmp 101 PID 4888 wrote to memory of 568 4888 7DFA.tmp 101 PID 4888 wrote to memory of 568 4888 7DFA.tmp 101 PID 568 wrote to memory of 2352 568 7E96.tmp 102 PID 568 wrote to memory of 2352 568 7E96.tmp 102 PID 568 wrote to memory of 2352 568 7E96.tmp 102 PID 2352 wrote to memory of 2060 2352 7F42.tmp 103 PID 2352 wrote to memory of 2060 2352 7F42.tmp 103 PID 2352 wrote to memory of 2060 2352 7F42.tmp 103 PID 2060 wrote to memory of 3616 2060 806B.tmp 104 PID 2060 wrote to memory of 3616 2060 806B.tmp 104 PID 2060 wrote to memory of 3616 2060 806B.tmp 104 PID 3616 wrote to memory of 1216 3616 80F7.tmp 105 PID 3616 wrote to memory of 1216 3616 80F7.tmp 105 PID 3616 wrote to memory of 1216 3616 80F7.tmp 105 PID 1216 wrote to memory of 5048 1216 81C3.tmp 108 PID 1216 wrote to memory of 5048 1216 81C3.tmp 108 PID 1216 wrote to memory of 5048 1216 81C3.tmp 108 PID 5048 wrote to memory of 3868 5048 828E.tmp 109 PID 5048 wrote to memory of 3868 5048 828E.tmp 109 PID 5048 wrote to memory of 3868 5048 828E.tmp 109 PID 3868 wrote to memory of 420 3868 8349.tmp 110 PID 3868 wrote to memory of 420 3868 8349.tmp 110 PID 3868 wrote to memory of 420 3868 8349.tmp 110 PID 420 wrote to memory of 3696 420 83B7.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_b7e9e492d2ebb928b252d16fbb64f301_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-26_b7e9e492d2ebb928b252d16fbb64f301_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"23⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"24⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"25⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"26⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"27⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"28⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"29⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"30⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"31⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"32⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"33⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"34⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"35⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"36⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"37⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"38⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"39⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"40⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"41⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"42⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"43⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"44⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"45⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"46⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"47⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"48⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"49⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"50⤵
- Executes dropped EXE
PID:236 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"51⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"52⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"53⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"54⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"55⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"56⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"57⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"58⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"59⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"60⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"61⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"62⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"63⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"64⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"65⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"66⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"67⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"68⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"69⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"70⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"71⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"72⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"73⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"74⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"75⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"76⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"77⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"78⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"79⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"80⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"81⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"82⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"83⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"84⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"85⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"86⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"87⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"88⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"89⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"90⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"91⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"92⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"93⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"94⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"95⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"96⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"97⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"98⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"99⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"100⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"101⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"102⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"103⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"104⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"105⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"106⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"107⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"108⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"109⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"110⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"111⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"112⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"113⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"114⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"115⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"116⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"117⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"118⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"119⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"120⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"121⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"122⤵PID:1772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-