Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 03:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-12_a09754bacc9aa5f25395444cd94e67da_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-12_a09754bacc9aa5f25395444cd94e67da_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-12_a09754bacc9aa5f25395444cd94e67da_mafia.exe
-
Size
536KB
-
MD5
a09754bacc9aa5f25395444cd94e67da
-
SHA1
5091a8cde002095315cb9b53db6ffaf6e123ed86
-
SHA256
26993a2c565aa4b3d1c0e85a2fb1715fc27a240c3aa97192eddc7485d78e900e
-
SHA512
51f736ef494ef75a95b67f55bcf0de349fb0faf1653736c55a239f8ce12a733582f044f08cc5fda3f846525ca20de9c692f1e23d01dd2f8b138669ae5debe35f
-
SSDEEP
12288:wU5rCOTeiUD1YwSea5LE5Q6Vt+1ipbIZxVJ0ZT9:wUQOJU5dSNvkyiVIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4668 74A3.tmp 2556 756E.tmp 3160 7688.tmp 3448 77D0.tmp 4420 78CA.tmp 4920 79C4.tmp 5116 7ACD.tmp 1168 7BC7.tmp 2708 7CE1.tmp 4284 7DBB.tmp 3440 7ED5.tmp 2276 804C.tmp 1944 8136.tmp 3008 8230.tmp 2924 832A.tmp 4900 8424.tmp 1916 851E.tmp 2188 85F9.tmp 3584 8702.tmp 4660 87FC.tmp 4508 88F6.tmp 408 8A2F.tmp 1012 8B67.tmp 2432 8C61.tmp 2320 8D4C.tmp 4716 8E65.tmp 4872 8F6F.tmp 2368 9069.tmp 4416 9153.tmp 4916 923D.tmp 3612 9357.tmp 2060 9470.tmp 1060 952B.tmp 4748 95B8.tmp 4432 9625.tmp 3500 96A2.tmp 3580 9700.tmp 892 977D.tmp 1624 980A.tmp 3592 9877.tmp 1908 9904.tmp 1248 9971.tmp 4332 99FE.tmp 2052 9A7B.tmp 960 9AE8.tmp 1688 9B65.tmp 4280 9BC3.tmp 2556 9C40.tmp 3344 9CAD.tmp 4444 9D2A.tmp 4944 9D98.tmp 1832 9E05.tmp 2144 9E82.tmp 4672 9EFF.tmp 3880 9F6C.tmp 2848 9FE9.tmp 2776 A057.tmp 1156 A0C4.tmp 4936 A141.tmp 100 A1AE.tmp 4664 A20C.tmp 5040 A299.tmp 4460 A325.tmp 1356 A393.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1280 wrote to memory of 4668 1280 2024-02-12_a09754bacc9aa5f25395444cd94e67da_mafia.exe 83 PID 1280 wrote to memory of 4668 1280 2024-02-12_a09754bacc9aa5f25395444cd94e67da_mafia.exe 83 PID 1280 wrote to memory of 4668 1280 2024-02-12_a09754bacc9aa5f25395444cd94e67da_mafia.exe 83 PID 4668 wrote to memory of 2556 4668 74A3.tmp 84 PID 4668 wrote to memory of 2556 4668 74A3.tmp 84 PID 4668 wrote to memory of 2556 4668 74A3.tmp 84 PID 2556 wrote to memory of 3160 2556 756E.tmp 85 PID 2556 wrote to memory of 3160 2556 756E.tmp 85 PID 2556 wrote to memory of 3160 2556 756E.tmp 85 PID 3160 wrote to memory of 3448 3160 7688.tmp 86 PID 3160 wrote to memory of 3448 3160 7688.tmp 86 PID 3160 wrote to memory of 3448 3160 7688.tmp 86 PID 3448 wrote to memory of 4420 3448 77D0.tmp 87 PID 3448 wrote to memory of 4420 3448 77D0.tmp 87 PID 3448 wrote to memory of 4420 3448 77D0.tmp 87 PID 4420 wrote to memory of 4920 4420 78CA.tmp 88 PID 4420 wrote to memory of 4920 4420 78CA.tmp 88 PID 4420 wrote to memory of 4920 4420 78CA.tmp 88 PID 4920 wrote to memory of 5116 4920 79C4.tmp 89 PID 4920 wrote to memory of 5116 4920 79C4.tmp 89 PID 4920 wrote to memory of 5116 4920 79C4.tmp 89 PID 5116 wrote to memory of 1168 5116 7ACD.tmp 90 PID 5116 wrote to memory of 1168 5116 7ACD.tmp 90 PID 5116 wrote to memory of 1168 5116 7ACD.tmp 90 PID 1168 wrote to memory of 2708 1168 7BC7.tmp 91 PID 1168 wrote to memory of 2708 1168 7BC7.tmp 91 PID 1168 wrote to memory of 2708 1168 7BC7.tmp 91 PID 2708 wrote to memory of 4284 2708 7CE1.tmp 92 PID 2708 wrote to memory of 4284 2708 7CE1.tmp 92 PID 2708 wrote to memory of 4284 2708 7CE1.tmp 92 PID 4284 wrote to memory of 3440 4284 7DBB.tmp 93 PID 4284 wrote to memory of 3440 4284 7DBB.tmp 93 PID 4284 wrote to memory of 3440 4284 7DBB.tmp 93 PID 3440 wrote to memory of 2276 3440 7ED5.tmp 94 PID 3440 wrote to memory of 2276 3440 7ED5.tmp 94 PID 3440 wrote to memory of 2276 3440 7ED5.tmp 94 PID 2276 wrote to memory of 1944 2276 804C.tmp 95 PID 2276 wrote to memory of 1944 2276 804C.tmp 95 PID 2276 wrote to memory of 1944 2276 804C.tmp 95 PID 1944 wrote to memory of 3008 1944 8136.tmp 96 PID 1944 wrote to memory of 3008 1944 8136.tmp 96 PID 1944 wrote to memory of 3008 1944 8136.tmp 96 PID 3008 wrote to memory of 2924 3008 8230.tmp 97 PID 3008 wrote to memory of 2924 3008 8230.tmp 97 PID 3008 wrote to memory of 2924 3008 8230.tmp 97 PID 2924 wrote to memory of 4900 2924 832A.tmp 98 PID 2924 wrote to memory of 4900 2924 832A.tmp 98 PID 2924 wrote to memory of 4900 2924 832A.tmp 98 PID 4900 wrote to memory of 1916 4900 8424.tmp 99 PID 4900 wrote to memory of 1916 4900 8424.tmp 99 PID 4900 wrote to memory of 1916 4900 8424.tmp 99 PID 1916 wrote to memory of 2188 1916 851E.tmp 100 PID 1916 wrote to memory of 2188 1916 851E.tmp 100 PID 1916 wrote to memory of 2188 1916 851E.tmp 100 PID 2188 wrote to memory of 3584 2188 85F9.tmp 101 PID 2188 wrote to memory of 3584 2188 85F9.tmp 101 PID 2188 wrote to memory of 3584 2188 85F9.tmp 101 PID 3584 wrote to memory of 4660 3584 8702.tmp 102 PID 3584 wrote to memory of 4660 3584 8702.tmp 102 PID 3584 wrote to memory of 4660 3584 8702.tmp 102 PID 4660 wrote to memory of 4508 4660 87FC.tmp 103 PID 4660 wrote to memory of 4508 4660 87FC.tmp 103 PID 4660 wrote to memory of 4508 4660 87FC.tmp 103 PID 4508 wrote to memory of 408 4508 88F6.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_a09754bacc9aa5f25395444cd94e67da_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_a09754bacc9aa5f25395444cd94e67da_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"23⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"24⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"25⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"26⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"27⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"28⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"29⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"30⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"31⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"32⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"33⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"34⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"35⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"36⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"37⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"38⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"39⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"40⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"41⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"42⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"43⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"44⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"45⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"46⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"47⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"48⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"49⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"50⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"51⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"52⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"53⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"54⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"55⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"56⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"57⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"58⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"59⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"60⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"61⤵
- Executes dropped EXE
PID:100 -
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"62⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"63⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"64⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"65⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"66⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"67⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"68⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"69⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"70⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"71⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"72⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"73⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"74⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"75⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"76⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"77⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"78⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"79⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"80⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"81⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"82⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"83⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"84⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"85⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"86⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"87⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"88⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"89⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"90⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"91⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"92⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"93⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"94⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"95⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"96⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"97⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"98⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"99⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"100⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"101⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"102⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"103⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"104⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"105⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"106⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"107⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\B798.tmp"C:\Users\Admin\AppData\Local\Temp\B798.tmp"108⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"109⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"110⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"111⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"112⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"113⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"114⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"115⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"116⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"117⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"118⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"119⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"120⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"121⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"122⤵PID:2980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-