Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 14:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-29_ac1fe77549be44a685674613b39cd0f9_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-29_ac1fe77549be44a685674613b39cd0f9_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-01-29_ac1fe77549be44a685674613b39cd0f9_mafia.exe
-
Size
520KB
-
MD5
ac1fe77549be44a685674613b39cd0f9
-
SHA1
5871736f8b018b6b7ffdb06e68228fa50e6c02f5
-
SHA256
1db7c7f866a599fcf873bb66bf5c92b36b1dbd9bf623c9b2f646d920ce22a5a3
-
SHA512
7d806aa0a0cb3ddfe7aab3c2fadc33ee1ff901ee05ad0277e3a007def731c59b8d980e65878b8d61ba004bf37a0198b0658535de43ff52237d31b779eb75d520
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjL6gMHLo+vZ0cVejkHuA8JdEnxoDQlrPeWKfps/:roRXOQjmOyuvCcVuJ5dMokLiZ6NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2384 B7F6.tmp 1096 B91E.tmp 2120 BEDB.tmp 4912 C014.tmp 3400 C12D.tmp 4152 C1E8.tmp 4604 C302.tmp 664 C3CD.tmp 4780 C488.tmp 3716 C525.tmp 1752 C60F.tmp 4396 C6DA.tmp 5064 C767.tmp 4828 C832.tmp 1208 C8CE.tmp 2084 C97A.tmp 912 CA16.tmp 4716 CA93.tmp 1876 CB5E.tmp 2128 CC1A.tmp 4712 CCA6.tmp 4988 CDCF.tmp 1680 CE5C.tmp 2284 CEF8.tmp 2584 CFA4.tmp 1664 D050.tmp 5040 D0EC.tmp 2020 D198.tmp 3092 D244.tmp 4072 D2F0.tmp 3636 D37C.tmp 1592 D419.tmp 2204 D496.tmp 1160 D513.tmp 968 D59F.tmp 4544 D61C.tmp 3844 D6A9.tmp 4728 D736.tmp 3644 D7B3.tmp 3300 D8AD.tmp 3420 D90A.tmp 2640 D978.tmp 1116 DA33.tmp 4108 DAC0.tmp 2404 DB3D.tmp 4844 DBBA.tmp 2720 DC75.tmp 3212 DD21.tmp 2668 DDAE.tmp 748 DE1B.tmp 2496 DE89.tmp 2420 DF44.tmp 4692 DFE0.tmp 2836 E04E.tmp 3272 E0DA.tmp 2300 E167.tmp 3548 E1E4.tmp 1080 E271.tmp 224 E2DE.tmp 2524 E36B.tmp 848 E3F7.tmp 5100 E465.tmp 4616 E4E2.tmp 4740 E55F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5052 wrote to memory of 2384 5052 2024-01-29_ac1fe77549be44a685674613b39cd0f9_mafia.exe 84 PID 5052 wrote to memory of 2384 5052 2024-01-29_ac1fe77549be44a685674613b39cd0f9_mafia.exe 84 PID 5052 wrote to memory of 2384 5052 2024-01-29_ac1fe77549be44a685674613b39cd0f9_mafia.exe 84 PID 2384 wrote to memory of 1096 2384 B7F6.tmp 85 PID 2384 wrote to memory of 1096 2384 B7F6.tmp 85 PID 2384 wrote to memory of 1096 2384 B7F6.tmp 85 PID 1096 wrote to memory of 2120 1096 B91E.tmp 86 PID 1096 wrote to memory of 2120 1096 B91E.tmp 86 PID 1096 wrote to memory of 2120 1096 B91E.tmp 86 PID 2120 wrote to memory of 4912 2120 BEDB.tmp 87 PID 2120 wrote to memory of 4912 2120 BEDB.tmp 87 PID 2120 wrote to memory of 4912 2120 BEDB.tmp 87 PID 4912 wrote to memory of 3400 4912 C014.tmp 88 PID 4912 wrote to memory of 3400 4912 C014.tmp 88 PID 4912 wrote to memory of 3400 4912 C014.tmp 88 PID 3400 wrote to memory of 4152 3400 C12D.tmp 89 PID 3400 wrote to memory of 4152 3400 C12D.tmp 89 PID 3400 wrote to memory of 4152 3400 C12D.tmp 89 PID 4152 wrote to memory of 4604 4152 C1E8.tmp 90 PID 4152 wrote to memory of 4604 4152 C1E8.tmp 90 PID 4152 wrote to memory of 4604 4152 C1E8.tmp 90 PID 4604 wrote to memory of 664 4604 C302.tmp 91 PID 4604 wrote to memory of 664 4604 C302.tmp 91 PID 4604 wrote to memory of 664 4604 C302.tmp 91 PID 664 wrote to memory of 4780 664 C3CD.tmp 92 PID 664 wrote to memory of 4780 664 C3CD.tmp 92 PID 664 wrote to memory of 4780 664 C3CD.tmp 92 PID 4780 wrote to memory of 3716 4780 C488.tmp 93 PID 4780 wrote to memory of 3716 4780 C488.tmp 93 PID 4780 wrote to memory of 3716 4780 C488.tmp 93 PID 3716 wrote to memory of 1752 3716 C525.tmp 94 PID 3716 wrote to memory of 1752 3716 C525.tmp 94 PID 3716 wrote to memory of 1752 3716 C525.tmp 94 PID 1752 wrote to memory of 4396 1752 C60F.tmp 95 PID 1752 wrote to memory of 4396 1752 C60F.tmp 95 PID 1752 wrote to memory of 4396 1752 C60F.tmp 95 PID 4396 wrote to memory of 5064 4396 C6DA.tmp 96 PID 4396 wrote to memory of 5064 4396 C6DA.tmp 96 PID 4396 wrote to memory of 5064 4396 C6DA.tmp 96 PID 5064 wrote to memory of 4828 5064 C767.tmp 97 PID 5064 wrote to memory of 4828 5064 C767.tmp 97 PID 5064 wrote to memory of 4828 5064 C767.tmp 97 PID 4828 wrote to memory of 1208 4828 C832.tmp 98 PID 4828 wrote to memory of 1208 4828 C832.tmp 98 PID 4828 wrote to memory of 1208 4828 C832.tmp 98 PID 1208 wrote to memory of 2084 1208 C8CE.tmp 99 PID 1208 wrote to memory of 2084 1208 C8CE.tmp 99 PID 1208 wrote to memory of 2084 1208 C8CE.tmp 99 PID 2084 wrote to memory of 912 2084 C97A.tmp 100 PID 2084 wrote to memory of 912 2084 C97A.tmp 100 PID 2084 wrote to memory of 912 2084 C97A.tmp 100 PID 912 wrote to memory of 4716 912 CA16.tmp 101 PID 912 wrote to memory of 4716 912 CA16.tmp 101 PID 912 wrote to memory of 4716 912 CA16.tmp 101 PID 4716 wrote to memory of 1876 4716 CA93.tmp 102 PID 4716 wrote to memory of 1876 4716 CA93.tmp 102 PID 4716 wrote to memory of 1876 4716 CA93.tmp 102 PID 1876 wrote to memory of 2128 1876 CB5E.tmp 103 PID 1876 wrote to memory of 2128 1876 CB5E.tmp 103 PID 1876 wrote to memory of 2128 1876 CB5E.tmp 103 PID 2128 wrote to memory of 4712 2128 CC1A.tmp 104 PID 2128 wrote to memory of 4712 2128 CC1A.tmp 104 PID 2128 wrote to memory of 4712 2128 CC1A.tmp 104 PID 4712 wrote to memory of 4988 4712 CCA6.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-29_ac1fe77549be44a685674613b39cd0f9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-29_ac1fe77549be44a685674613b39cd0f9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\CA16.tmp"C:\Users\Admin\AppData\Local\Temp\CA16.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"23⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"24⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"25⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"26⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"27⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"28⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"29⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\D244.tmp"C:\Users\Admin\AppData\Local\Temp\D244.tmp"30⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"31⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"32⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"33⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\D496.tmp"C:\Users\Admin\AppData\Local\Temp\D496.tmp"34⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\D513.tmp"C:\Users\Admin\AppData\Local\Temp\D513.tmp"35⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"36⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\D61C.tmp"C:\Users\Admin\AppData\Local\Temp\D61C.tmp"37⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"38⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\D736.tmp"C:\Users\Admin\AppData\Local\Temp\D736.tmp"39⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"40⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"41⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"42⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\D978.tmp"C:\Users\Admin\AppData\Local\Temp\D978.tmp"43⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\DA33.tmp"C:\Users\Admin\AppData\Local\Temp\DA33.tmp"44⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"45⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"46⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"47⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"48⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"49⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"50⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"51⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\DE89.tmp"C:\Users\Admin\AppData\Local\Temp\DE89.tmp"52⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"53⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"54⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"55⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"56⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"57⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"58⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"59⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"60⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"61⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"62⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"63⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"64⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"65⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"66⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"67⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"68⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"69⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"70⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"71⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"72⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"73⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"74⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"75⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\EADD.tmp"C:\Users\Admin\AppData\Local\Temp\EADD.tmp"76⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"77⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"78⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\EC83.tmp"C:\Users\Admin\AppData\Local\Temp\EC83.tmp"79⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\ED00.tmp"C:\Users\Admin\AppData\Local\Temp\ED00.tmp"80⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"81⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"82⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"83⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"84⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\EF71.tmp"C:\Users\Admin\AppData\Local\Temp\EF71.tmp"85⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"86⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\F05B.tmp"C:\Users\Admin\AppData\Local\Temp\F05B.tmp"87⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"88⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"89⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"90⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\F29D.tmp"C:\Users\Admin\AppData\Local\Temp\F29D.tmp"91⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\F30B.tmp"C:\Users\Admin\AppData\Local\Temp\F30B.tmp"92⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\F378.tmp"C:\Users\Admin\AppData\Local\Temp\F378.tmp"93⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"94⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\F453.tmp"C:\Users\Admin\AppData\Local\Temp\F453.tmp"95⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"96⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\F55C.tmp"C:\Users\Admin\AppData\Local\Temp\F55C.tmp"97⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"98⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"99⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\F770.tmp"C:\Users\Admin\AppData\Local\Temp\F770.tmp"100⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"101⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\F889.tmp"C:\Users\Admin\AppData\Local\Temp\F889.tmp"102⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"103⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"104⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"105⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"106⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"107⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"108⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"109⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"110⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"111⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\FE17.tmp"C:\Users\Admin\AppData\Local\Temp\FE17.tmp"112⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"113⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\FF30.tmp"C:\Users\Admin\AppData\Local\Temp\FF30.tmp"114⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"115⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A.tmp"116⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\97.tmp"C:\Users\Admin\AppData\Local\Temp\97.tmp"117⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"118⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\1EF.tmp"C:\Users\Admin\AppData\Local\Temp\1EF.tmp"119⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"120⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\2D9.tmp"C:\Users\Admin\AppData\Local\Temp\2D9.tmp"121⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"122⤵PID:4580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-