Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2024 12:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-01_0b261be57ee3bfc6e70c2743f2e76239_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-01_0b261be57ee3bfc6e70c2743f2e76239_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-01_0b261be57ee3bfc6e70c2743f2e76239_mafia.exe
-
Size
487KB
-
MD5
0b261be57ee3bfc6e70c2743f2e76239
-
SHA1
0a1141c9dbf88e3772b3e338d6dda7bb82776e95
-
SHA256
e88678a86fa4f0f956b512428843afb53d84ebdee8fec91aafec097362e23eee
-
SHA512
a763dd5c6c18c0f538d31d27c89926b7ca32649e97db47261d99a716e2020742fb55c8a596ebddcf216a85ebb7e09b6f9adecbe43608e884855e8e88a2835d83
-
SSDEEP
12288:yU5rCOTeiNSwcW40p4MfbVMUx3gZffn/1/XAbZ:yUQOJNV4MT3wZH9Ib
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2844 6949.tmp 1340 69E5.tmp 1296 6AB0.tmp 4056 6B7B.tmp 1868 6C08.tmp 1184 6CB4.tmp 4696 6D6F.tmp 4844 6DFC.tmp 3644 6E79.tmp 1624 6EF6.tmp 2528 6F73.tmp 884 6FE0.tmp 2192 706D.tmp 924 70FA.tmp 2900 7177.tmp 3132 7242.tmp 1284 72CE.tmp 4600 735B.tmp 2684 73E8.tmp 1888 7474.tmp 4864 74D2.tmp 4700 757E.tmp 1584 7649.tmp 1008 76B6.tmp 1224 7743.tmp 2216 77DF.tmp 2840 786C.tmp 1728 7918.tmp 4976 7985.tmp 1388 7A21.tmp 4648 7ABE.tmp 748 7B5A.tmp 4216 7BD7.tmp 3848 7C44.tmp 2280 7CB2.tmp 4284 7D1F.tmp 3452 7DAC.tmp 3208 7E29.tmp 4960 7E96.tmp 3884 7F03.tmp 3768 7F71.tmp 1696 7FEE.tmp 1524 80F7.tmp 2524 81F1.tmp 852 8378.tmp 812 84A1.tmp 1872 854D.tmp 4676 8628.tmp 2812 878F.tmp 4720 882B.tmp 1452 88B8.tmp 1856 8954.tmp 4148 8A00.tmp 3212 8A7D.tmp 3100 8B19.tmp 1572 8BB5.tmp 3468 8C42.tmp 1376 8CAF.tmp 1168 8D3C.tmp 4652 8DC9.tmp 1420 8E65.tmp 5084 8F11.tmp 3792 8F9D.tmp 2072 8FFB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1160 wrote to memory of 2844 1160 2024-02-01_0b261be57ee3bfc6e70c2743f2e76239_mafia.exe 84 PID 1160 wrote to memory of 2844 1160 2024-02-01_0b261be57ee3bfc6e70c2743f2e76239_mafia.exe 84 PID 1160 wrote to memory of 2844 1160 2024-02-01_0b261be57ee3bfc6e70c2743f2e76239_mafia.exe 84 PID 2844 wrote to memory of 1340 2844 6949.tmp 85 PID 2844 wrote to memory of 1340 2844 6949.tmp 85 PID 2844 wrote to memory of 1340 2844 6949.tmp 85 PID 1340 wrote to memory of 1296 1340 69E5.tmp 86 PID 1340 wrote to memory of 1296 1340 69E5.tmp 86 PID 1340 wrote to memory of 1296 1340 69E5.tmp 86 PID 1296 wrote to memory of 4056 1296 6AB0.tmp 87 PID 1296 wrote to memory of 4056 1296 6AB0.tmp 87 PID 1296 wrote to memory of 4056 1296 6AB0.tmp 87 PID 4056 wrote to memory of 1868 4056 6B7B.tmp 88 PID 4056 wrote to memory of 1868 4056 6B7B.tmp 88 PID 4056 wrote to memory of 1868 4056 6B7B.tmp 88 PID 1868 wrote to memory of 1184 1868 6C08.tmp 89 PID 1868 wrote to memory of 1184 1868 6C08.tmp 89 PID 1868 wrote to memory of 1184 1868 6C08.tmp 89 PID 1184 wrote to memory of 4696 1184 6CB4.tmp 90 PID 1184 wrote to memory of 4696 1184 6CB4.tmp 90 PID 1184 wrote to memory of 4696 1184 6CB4.tmp 90 PID 4696 wrote to memory of 4844 4696 6D6F.tmp 91 PID 4696 wrote to memory of 4844 4696 6D6F.tmp 91 PID 4696 wrote to memory of 4844 4696 6D6F.tmp 91 PID 4844 wrote to memory of 3644 4844 6DFC.tmp 92 PID 4844 wrote to memory of 3644 4844 6DFC.tmp 92 PID 4844 wrote to memory of 3644 4844 6DFC.tmp 92 PID 3644 wrote to memory of 1624 3644 6E79.tmp 93 PID 3644 wrote to memory of 1624 3644 6E79.tmp 93 PID 3644 wrote to memory of 1624 3644 6E79.tmp 93 PID 1624 wrote to memory of 2528 1624 6EF6.tmp 94 PID 1624 wrote to memory of 2528 1624 6EF6.tmp 94 PID 1624 wrote to memory of 2528 1624 6EF6.tmp 94 PID 2528 wrote to memory of 884 2528 6F73.tmp 95 PID 2528 wrote to memory of 884 2528 6F73.tmp 95 PID 2528 wrote to memory of 884 2528 6F73.tmp 95 PID 884 wrote to memory of 2192 884 6FE0.tmp 96 PID 884 wrote to memory of 2192 884 6FE0.tmp 96 PID 884 wrote to memory of 2192 884 6FE0.tmp 96 PID 2192 wrote to memory of 924 2192 706D.tmp 97 PID 2192 wrote to memory of 924 2192 706D.tmp 97 PID 2192 wrote to memory of 924 2192 706D.tmp 97 PID 924 wrote to memory of 2900 924 70FA.tmp 98 PID 924 wrote to memory of 2900 924 70FA.tmp 98 PID 924 wrote to memory of 2900 924 70FA.tmp 98 PID 2900 wrote to memory of 3132 2900 7177.tmp 99 PID 2900 wrote to memory of 3132 2900 7177.tmp 99 PID 2900 wrote to memory of 3132 2900 7177.tmp 99 PID 3132 wrote to memory of 1284 3132 7242.tmp 100 PID 3132 wrote to memory of 1284 3132 7242.tmp 100 PID 3132 wrote to memory of 1284 3132 7242.tmp 100 PID 1284 wrote to memory of 4600 1284 72CE.tmp 101 PID 1284 wrote to memory of 4600 1284 72CE.tmp 101 PID 1284 wrote to memory of 4600 1284 72CE.tmp 101 PID 4600 wrote to memory of 2684 4600 735B.tmp 102 PID 4600 wrote to memory of 2684 4600 735B.tmp 102 PID 4600 wrote to memory of 2684 4600 735B.tmp 102 PID 2684 wrote to memory of 1888 2684 73E8.tmp 103 PID 2684 wrote to memory of 1888 2684 73E8.tmp 103 PID 2684 wrote to memory of 1888 2684 73E8.tmp 103 PID 1888 wrote to memory of 4864 1888 7474.tmp 104 PID 1888 wrote to memory of 4864 1888 7474.tmp 104 PID 1888 wrote to memory of 4864 1888 7474.tmp 104 PID 4864 wrote to memory of 4700 4864 74D2.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-01_0b261be57ee3bfc6e70c2743f2e76239_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-01_0b261be57ee3bfc6e70c2743f2e76239_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"23⤵
- Executes dropped EXE
PID:4700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"1⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"2⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"3⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"4⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"5⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"6⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"7⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"8⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"9⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"10⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"11⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"12⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"13⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"14⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"15⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"16⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"17⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"18⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"19⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"20⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"21⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"22⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"23⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"24⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"25⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"26⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"27⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"28⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"29⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"30⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"31⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"32⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"33⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"34⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"35⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"36⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"37⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"38⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"39⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"40⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"41⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"42⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"43⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"44⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"45⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"46⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"47⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"48⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"49⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"50⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"51⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"52⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"53⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"54⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"55⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"56⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"57⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"58⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"59⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"60⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"61⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"62⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"63⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"64⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"65⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"66⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"67⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"68⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"69⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"70⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"71⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"72⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"73⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"74⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"75⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"76⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"77⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"78⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"79⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"80⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"81⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"82⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"83⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"84⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"85⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"86⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"87⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"88⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"89⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"90⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"91⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"92⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"93⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"94⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"95⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"96⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"97⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"98⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"99⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"100⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"101⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"102⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"103⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"104⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"105⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"106⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"107⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"108⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"109⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"110⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"111⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"112⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"113⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"114⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"115⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"116⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"117⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"118⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"119⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"120⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"121⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"122⤵PID:748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-