Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 01:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-12_262767dd91658c43f439f00d4f4b9157_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-12_262767dd91658c43f439f00d4f4b9157_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-12_262767dd91658c43f439f00d4f4b9157_mafia.exe
-
Size
520KB
-
MD5
262767dd91658c43f439f00d4f4b9157
-
SHA1
19d92290ca35f130299874a6c81a377ac59984bf
-
SHA256
9893e667217ba48395b14b1368bd193ec97bc4601808c130a2addc3bc6b8c324
-
SHA512
501853c1cf29bc8744b799034786b512878447e060e91fe91e589eb075cbd6b65085f7e48f3cf66ef92243b6de893d750640a97ca6479a23c0f9631e27a06458
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLOJI77nw4ShGGDSVPf9lZjc+5nGnE/hDeQsH3j:roRXOQjmOy+ynShG7RLvnGE5DONZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4412 7753.tmp 4856 781E.tmp 2356 78D9.tmp 1500 79F3.tmp 4820 7ADD.tmp 3384 7B4A.tmp 4408 7C06.tmp 732 7CA2.tmp 4196 7D6D.tmp 5024 7DFA.tmp 4112 7ED5.tmp 384 7F61.tmp 5044 7FFD.tmp 4276 80B9.tmp 3928 81B3.tmp 1460 826E.tmp 3576 8359.tmp 824 84EF.tmp 4164 85D9.tmp 2640 8676.tmp 3584 8750.tmp 3836 883B.tmp 3428 8935.tmp 4568 89E1.tmp 540 8A8D.tmp 1528 8B67.tmp 4628 8C32.tmp 4768 8D1D.tmp 2364 8DB9.tmp 1800 8E55.tmp 1576 8F20.tmp 3532 8FEC.tmp 1580 90A7.tmp 5092 9105.tmp 1624 9172.tmp 3688 920E.tmp 1900 929B.tmp 4492 9318.tmp 1616 93B4.tmp 3484 9441.tmp 3008 94BE.tmp 3432 955A.tmp 3636 95D7.tmp 4560 9664.tmp 2192 96E1.tmp 2820 976D.tmp 2324 97FA.tmp 3852 9867.tmp 760 9904.tmp 4972 9990.tmp 1144 9A2D.tmp 672 9AE8.tmp 4480 9B75.tmp 4332 9C11.tmp 4668 9C9E.tmp 676 9D2A.tmp 4412 9D88.tmp 1256 9E05.tmp 1208 9E82.tmp 4476 9EFF.tmp 380 9F8C.tmp 4472 A018.tmp 2404 A0B4.tmp 4860 A141.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3996 wrote to memory of 4412 3996 2024-02-12_262767dd91658c43f439f00d4f4b9157_mafia.exe 84 PID 3996 wrote to memory of 4412 3996 2024-02-12_262767dd91658c43f439f00d4f4b9157_mafia.exe 84 PID 3996 wrote to memory of 4412 3996 2024-02-12_262767dd91658c43f439f00d4f4b9157_mafia.exe 84 PID 4412 wrote to memory of 4856 4412 7753.tmp 85 PID 4412 wrote to memory of 4856 4412 7753.tmp 85 PID 4412 wrote to memory of 4856 4412 7753.tmp 85 PID 4856 wrote to memory of 2356 4856 781E.tmp 86 PID 4856 wrote to memory of 2356 4856 781E.tmp 86 PID 4856 wrote to memory of 2356 4856 781E.tmp 86 PID 2356 wrote to memory of 1500 2356 78D9.tmp 87 PID 2356 wrote to memory of 1500 2356 78D9.tmp 87 PID 2356 wrote to memory of 1500 2356 78D9.tmp 87 PID 1500 wrote to memory of 4820 1500 79F3.tmp 88 PID 1500 wrote to memory of 4820 1500 79F3.tmp 88 PID 1500 wrote to memory of 4820 1500 79F3.tmp 88 PID 4820 wrote to memory of 3384 4820 7ADD.tmp 89 PID 4820 wrote to memory of 3384 4820 7ADD.tmp 89 PID 4820 wrote to memory of 3384 4820 7ADD.tmp 89 PID 3384 wrote to memory of 4408 3384 7B4A.tmp 90 PID 3384 wrote to memory of 4408 3384 7B4A.tmp 90 PID 3384 wrote to memory of 4408 3384 7B4A.tmp 90 PID 4408 wrote to memory of 732 4408 7C06.tmp 91 PID 4408 wrote to memory of 732 4408 7C06.tmp 91 PID 4408 wrote to memory of 732 4408 7C06.tmp 91 PID 732 wrote to memory of 4196 732 7CA2.tmp 92 PID 732 wrote to memory of 4196 732 7CA2.tmp 92 PID 732 wrote to memory of 4196 732 7CA2.tmp 92 PID 4196 wrote to memory of 5024 4196 7D6D.tmp 93 PID 4196 wrote to memory of 5024 4196 7D6D.tmp 93 PID 4196 wrote to memory of 5024 4196 7D6D.tmp 93 PID 5024 wrote to memory of 4112 5024 7DFA.tmp 94 PID 5024 wrote to memory of 4112 5024 7DFA.tmp 94 PID 5024 wrote to memory of 4112 5024 7DFA.tmp 94 PID 4112 wrote to memory of 384 4112 7ED5.tmp 95 PID 4112 wrote to memory of 384 4112 7ED5.tmp 95 PID 4112 wrote to memory of 384 4112 7ED5.tmp 95 PID 384 wrote to memory of 5044 384 7F61.tmp 96 PID 384 wrote to memory of 5044 384 7F61.tmp 96 PID 384 wrote to memory of 5044 384 7F61.tmp 96 PID 5044 wrote to memory of 4276 5044 7FFD.tmp 97 PID 5044 wrote to memory of 4276 5044 7FFD.tmp 97 PID 5044 wrote to memory of 4276 5044 7FFD.tmp 97 PID 4276 wrote to memory of 3928 4276 80B9.tmp 98 PID 4276 wrote to memory of 3928 4276 80B9.tmp 98 PID 4276 wrote to memory of 3928 4276 80B9.tmp 98 PID 3928 wrote to memory of 1460 3928 81B3.tmp 99 PID 3928 wrote to memory of 1460 3928 81B3.tmp 99 PID 3928 wrote to memory of 1460 3928 81B3.tmp 99 PID 1460 wrote to memory of 3576 1460 826E.tmp 100 PID 1460 wrote to memory of 3576 1460 826E.tmp 100 PID 1460 wrote to memory of 3576 1460 826E.tmp 100 PID 3576 wrote to memory of 824 3576 8359.tmp 101 PID 3576 wrote to memory of 824 3576 8359.tmp 101 PID 3576 wrote to memory of 824 3576 8359.tmp 101 PID 824 wrote to memory of 4164 824 84EF.tmp 102 PID 824 wrote to memory of 4164 824 84EF.tmp 102 PID 824 wrote to memory of 4164 824 84EF.tmp 102 PID 4164 wrote to memory of 2640 4164 85D9.tmp 103 PID 4164 wrote to memory of 2640 4164 85D9.tmp 103 PID 4164 wrote to memory of 2640 4164 85D9.tmp 103 PID 2640 wrote to memory of 3584 2640 8676.tmp 104 PID 2640 wrote to memory of 3584 2640 8676.tmp 104 PID 2640 wrote to memory of 3584 2640 8676.tmp 104 PID 3584 wrote to memory of 3836 3584 8750.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_262767dd91658c43f439f00d4f4b9157_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_262767dd91658c43f439f00d4f4b9157_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"23⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"24⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"25⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"26⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"27⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"28⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"29⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"30⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"31⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"32⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"33⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"34⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"35⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"36⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"37⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"38⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"39⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"40⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"41⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"42⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"43⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"44⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"45⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"46⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"47⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"48⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"49⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"50⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"51⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"52⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"53⤵
- Executes dropped EXE
PID:672 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"54⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"55⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"56⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"57⤵
- Executes dropped EXE
PID:676 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"58⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"59⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"60⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"61⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"62⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"63⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"64⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"65⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"66⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"67⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"68⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"69⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"70⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"71⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"72⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"73⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"74⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"75⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"76⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"77⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"78⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"79⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"80⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"81⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"82⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"83⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"84⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"85⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"86⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"87⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"88⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"89⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"90⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"91⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"92⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"93⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"94⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"95⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"96⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"97⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"98⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"99⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"100⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"101⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"102⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"103⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"104⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"105⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"106⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"107⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"108⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"109⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"110⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"111⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"112⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"113⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"114⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"115⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"116⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"117⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"118⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"119⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"120⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"121⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"122⤵PID:3444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-