Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2024 13:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe
-
Size
486KB
-
MD5
1ee91e138dcebe2fd95404441d95e1c0
-
SHA1
c84de2b1813a39d6dfffe2ed21c4b386be6387cf
-
SHA256
79378e323461c04737d8a774cf9115ed549f828452ce8daeb2e1d93a3bb9c80d
-
SHA512
eefbd9df22a77da74820ea19f164fc416a131ba6e58bac20088de261919abd3b7011691e23a1a0d09d2c74a04f6e95eb6a1ee9c0e1458a98be142ea1340c8828
-
SSDEEP
12288:/U5rCOTeiD/LWul+npm3BqZvTPaIEaYoNZ:/UQOJD/LHA43AZvTPaIEboN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1716 832A.tmp 2620 83C6.tmp 2712 8491.tmp 1480 855C.tmp 4840 85F9.tmp 2560 8676.tmp 632 8712.tmp 2316 87BE.tmp 2192 884A.tmp 4908 8916.tmp 468 8E26.tmp 3604 8EC3.tmp 2252 8F5F.tmp 3112 8FDC.tmp 556 9088.tmp 4044 9143.tmp 1476 91EF.tmp 676 927C.tmp 820 92F9.tmp 2580 9385.tmp 540 9441.tmp 2424 951C.tmp 4960 95B8.tmp 4000 9654.tmp 1588 9710.tmp 3332 97DB.tmp 2224 9867.tmp 3924 9923.tmp 2816 99BF.tmp 4780 9AAA.tmp 5024 9B27.tmp 3912 9BB3.tmp 4400 9C30.tmp 5040 9C8E.tmp 4920 9D0B.tmp 1724 9E05.tmp 3704 9E92.tmp 1492 9F3D.tmp 4500 9FBA.tmp 1508 A057.tmp 3464 A0E3.tmp 1560 A180.tmp 4840 A21C.tmp 1592 A2B8.tmp 2560 A345.tmp 632 A3D1.tmp 116 A43F.tmp 2160 A4CB.tmp 4708 A558.tmp 1664 A5E5.tmp 2604 A671.tmp 2944 A6FE.tmp 3620 A77B.tmp 1128 A827.tmp 4476 A894.tmp 2384 A921.tmp 3112 A9BD.tmp 1572 AA3A.tmp 3968 AAD6.tmp 4556 AB53.tmp 2880 ABD0.tmp 2188 AC4D.tmp 3260 ACF9.tmp 3116 AD95.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2848 wrote to memory of 1716 2848 2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe 87 PID 2848 wrote to memory of 1716 2848 2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe 87 PID 2848 wrote to memory of 1716 2848 2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe 87 PID 1716 wrote to memory of 2620 1716 832A.tmp 88 PID 1716 wrote to memory of 2620 1716 832A.tmp 88 PID 1716 wrote to memory of 2620 1716 832A.tmp 88 PID 2620 wrote to memory of 2712 2620 83C6.tmp 89 PID 2620 wrote to memory of 2712 2620 83C6.tmp 89 PID 2620 wrote to memory of 2712 2620 83C6.tmp 89 PID 2712 wrote to memory of 1480 2712 8491.tmp 90 PID 2712 wrote to memory of 1480 2712 8491.tmp 90 PID 2712 wrote to memory of 1480 2712 8491.tmp 90 PID 1480 wrote to memory of 4840 1480 855C.tmp 91 PID 1480 wrote to memory of 4840 1480 855C.tmp 91 PID 1480 wrote to memory of 4840 1480 855C.tmp 91 PID 4840 wrote to memory of 2560 4840 85F9.tmp 92 PID 4840 wrote to memory of 2560 4840 85F9.tmp 92 PID 4840 wrote to memory of 2560 4840 85F9.tmp 92 PID 2560 wrote to memory of 632 2560 8676.tmp 93 PID 2560 wrote to memory of 632 2560 8676.tmp 93 PID 2560 wrote to memory of 632 2560 8676.tmp 93 PID 632 wrote to memory of 2316 632 8712.tmp 94 PID 632 wrote to memory of 2316 632 8712.tmp 94 PID 632 wrote to memory of 2316 632 8712.tmp 94 PID 2316 wrote to memory of 2192 2316 87BE.tmp 95 PID 2316 wrote to memory of 2192 2316 87BE.tmp 95 PID 2316 wrote to memory of 2192 2316 87BE.tmp 95 PID 2192 wrote to memory of 4908 2192 884A.tmp 96 PID 2192 wrote to memory of 4908 2192 884A.tmp 96 PID 2192 wrote to memory of 4908 2192 884A.tmp 96 PID 4908 wrote to memory of 468 4908 8916.tmp 97 PID 4908 wrote to memory of 468 4908 8916.tmp 97 PID 4908 wrote to memory of 468 4908 8916.tmp 97 PID 468 wrote to memory of 3604 468 8E26.tmp 98 PID 468 wrote to memory of 3604 468 8E26.tmp 98 PID 468 wrote to memory of 3604 468 8E26.tmp 98 PID 3604 wrote to memory of 2252 3604 8EC3.tmp 99 PID 3604 wrote to memory of 2252 3604 8EC3.tmp 99 PID 3604 wrote to memory of 2252 3604 8EC3.tmp 99 PID 2252 wrote to memory of 3112 2252 8F5F.tmp 100 PID 2252 wrote to memory of 3112 2252 8F5F.tmp 100 PID 2252 wrote to memory of 3112 2252 8F5F.tmp 100 PID 3112 wrote to memory of 556 3112 8FDC.tmp 101 PID 3112 wrote to memory of 556 3112 8FDC.tmp 101 PID 3112 wrote to memory of 556 3112 8FDC.tmp 101 PID 556 wrote to memory of 4044 556 9088.tmp 102 PID 556 wrote to memory of 4044 556 9088.tmp 102 PID 556 wrote to memory of 4044 556 9088.tmp 102 PID 4044 wrote to memory of 1476 4044 9143.tmp 103 PID 4044 wrote to memory of 1476 4044 9143.tmp 103 PID 4044 wrote to memory of 1476 4044 9143.tmp 103 PID 1476 wrote to memory of 676 1476 91EF.tmp 104 PID 1476 wrote to memory of 676 1476 91EF.tmp 104 PID 1476 wrote to memory of 676 1476 91EF.tmp 104 PID 676 wrote to memory of 820 676 927C.tmp 105 PID 676 wrote to memory of 820 676 927C.tmp 105 PID 676 wrote to memory of 820 676 927C.tmp 105 PID 820 wrote to memory of 2580 820 92F9.tmp 106 PID 820 wrote to memory of 2580 820 92F9.tmp 106 PID 820 wrote to memory of 2580 820 92F9.tmp 106 PID 2580 wrote to memory of 540 2580 9385.tmp 109 PID 2580 wrote to memory of 540 2580 9385.tmp 109 PID 2580 wrote to memory of 540 2580 9385.tmp 109 PID 540 wrote to memory of 2424 540 9441.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"23⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"24⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"25⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"26⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"27⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"28⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"29⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"30⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"31⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"32⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"33⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"34⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"35⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"36⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"37⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"38⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"39⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"40⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"41⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"42⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"43⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"44⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"45⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"46⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"47⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"48⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"49⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"50⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"51⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"52⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"53⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"54⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"55⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"56⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"57⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"58⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"59⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"60⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"61⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"62⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"63⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"64⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"65⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"66⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"67⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"68⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"69⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"70⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"71⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"72⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"73⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"74⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"75⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"76⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"77⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"78⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"79⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"80⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"81⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"82⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"83⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"84⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"85⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"86⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"87⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"88⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"89⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"90⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"91⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"92⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"93⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"94⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"95⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"96⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"97⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"98⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"99⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"100⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"101⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"102⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"103⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"104⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"105⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"106⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"107⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"108⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"109⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"110⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"111⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"112⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"113⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"114⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"115⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"116⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"117⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"118⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"119⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"120⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"121⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"122⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-