Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 18:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-12_1a50754d2035b1baadc5d27d412139eb_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-12_1a50754d2035b1baadc5d27d412139eb_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-12_1a50754d2035b1baadc5d27d412139eb_mafia.exe
-
Size
488KB
-
MD5
1a50754d2035b1baadc5d27d412139eb
-
SHA1
f2092f4b69b1c31cdf3b54eed23f4979df0f5b23
-
SHA256
e0d2057e3c4cd70df91a33d472c63b97b195505943c52e89f901c1901e39541f
-
SHA512
4de68488ba0971364fd9ebe37efffbabb70e6002ad777c995fc10ba144b6487b9b8467a207b6adfa96dab0690e013151a891936398dd191b38e8faea22ec09e4
-
SSDEEP
12288:/U5rCOTeiDNllp4mglYxwi0197QsrLst1kNZ:/UQOJD3r4dYxwFBstCN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4960 6A43.tmp 1608 6B0E.tmp 1412 6BD9.tmp 2572 6CA4.tmp 536 71D4.tmp 2308 7271.tmp 3736 731D.tmp 4288 73D8.tmp 560 7474.tmp 2620 754F.tmp 2960 75FB.tmp 372 76F5.tmp 3576 77D0.tmp 5056 787C.tmp 4328 7937.tmp 4068 79E3.tmp 2532 7A70.tmp 4844 7B5A.tmp 928 7C44.tmp 3204 7D00.tmp 3300 7DEA.tmp 4524 7ED5.tmp 2608 7FAF.tmp 4492 807A.tmp 572 8136.tmp 1440 81D2.tmp 3952 824F.tmp 3564 82EB.tmp 4404 83C6.tmp 1836 8482.tmp 1328 851E.tmp 3368 85BA.tmp 2388 8666.tmp 1600 86E3.tmp 1444 8770.tmp 3016 87ED.tmp 2828 8879.tmp 3532 8916.tmp 5036 8993.tmp 2472 8A4E.tmp 3476 8AEA.tmp 4500 8B87.tmp 3800 8C04.tmp 1416 8C71.tmp 1220 8CEE.tmp 1824 8D5B.tmp 4964 8DD8.tmp 2740 8E75.tmp 4800 8EF2.tmp 4472 91EF.tmp 4016 923D.tmp 4660 929B.tmp 1372 92E9.tmp 5060 9366.tmp 3656 93F3.tmp 1700 947F.tmp 4736 953B.tmp 4444 95C8.tmp 1196 9645.tmp 4552 96E1.tmp 3168 974E.tmp 4732 97EA.tmp 784 9896.tmp 372 9913.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 656 wrote to memory of 4960 656 2024-02-12_1a50754d2035b1baadc5d27d412139eb_mafia.exe 84 PID 656 wrote to memory of 4960 656 2024-02-12_1a50754d2035b1baadc5d27d412139eb_mafia.exe 84 PID 656 wrote to memory of 4960 656 2024-02-12_1a50754d2035b1baadc5d27d412139eb_mafia.exe 84 PID 4960 wrote to memory of 1608 4960 6A43.tmp 85 PID 4960 wrote to memory of 1608 4960 6A43.tmp 85 PID 4960 wrote to memory of 1608 4960 6A43.tmp 85 PID 1608 wrote to memory of 1412 1608 6B0E.tmp 86 PID 1608 wrote to memory of 1412 1608 6B0E.tmp 86 PID 1608 wrote to memory of 1412 1608 6B0E.tmp 86 PID 1412 wrote to memory of 2572 1412 6BD9.tmp 87 PID 1412 wrote to memory of 2572 1412 6BD9.tmp 87 PID 1412 wrote to memory of 2572 1412 6BD9.tmp 87 PID 2572 wrote to memory of 536 2572 6CA4.tmp 88 PID 2572 wrote to memory of 536 2572 6CA4.tmp 88 PID 2572 wrote to memory of 536 2572 6CA4.tmp 88 PID 536 wrote to memory of 2308 536 71D4.tmp 89 PID 536 wrote to memory of 2308 536 71D4.tmp 89 PID 536 wrote to memory of 2308 536 71D4.tmp 89 PID 2308 wrote to memory of 3736 2308 7271.tmp 90 PID 2308 wrote to memory of 3736 2308 7271.tmp 90 PID 2308 wrote to memory of 3736 2308 7271.tmp 90 PID 3736 wrote to memory of 4288 3736 731D.tmp 91 PID 3736 wrote to memory of 4288 3736 731D.tmp 91 PID 3736 wrote to memory of 4288 3736 731D.tmp 91 PID 4288 wrote to memory of 560 4288 73D8.tmp 92 PID 4288 wrote to memory of 560 4288 73D8.tmp 92 PID 4288 wrote to memory of 560 4288 73D8.tmp 92 PID 560 wrote to memory of 2620 560 7474.tmp 93 PID 560 wrote to memory of 2620 560 7474.tmp 93 PID 560 wrote to memory of 2620 560 7474.tmp 93 PID 2620 wrote to memory of 2960 2620 754F.tmp 94 PID 2620 wrote to memory of 2960 2620 754F.tmp 94 PID 2620 wrote to memory of 2960 2620 754F.tmp 94 PID 2960 wrote to memory of 372 2960 75FB.tmp 95 PID 2960 wrote to memory of 372 2960 75FB.tmp 95 PID 2960 wrote to memory of 372 2960 75FB.tmp 95 PID 372 wrote to memory of 3576 372 76F5.tmp 96 PID 372 wrote to memory of 3576 372 76F5.tmp 96 PID 372 wrote to memory of 3576 372 76F5.tmp 96 PID 3576 wrote to memory of 5056 3576 77D0.tmp 97 PID 3576 wrote to memory of 5056 3576 77D0.tmp 97 PID 3576 wrote to memory of 5056 3576 77D0.tmp 97 PID 5056 wrote to memory of 4328 5056 787C.tmp 98 PID 5056 wrote to memory of 4328 5056 787C.tmp 98 PID 5056 wrote to memory of 4328 5056 787C.tmp 98 PID 4328 wrote to memory of 4068 4328 7937.tmp 99 PID 4328 wrote to memory of 4068 4328 7937.tmp 99 PID 4328 wrote to memory of 4068 4328 7937.tmp 99 PID 4068 wrote to memory of 2532 4068 79E3.tmp 100 PID 4068 wrote to memory of 2532 4068 79E3.tmp 100 PID 4068 wrote to memory of 2532 4068 79E3.tmp 100 PID 2532 wrote to memory of 4844 2532 7A70.tmp 101 PID 2532 wrote to memory of 4844 2532 7A70.tmp 101 PID 2532 wrote to memory of 4844 2532 7A70.tmp 101 PID 4844 wrote to memory of 928 4844 7B5A.tmp 102 PID 4844 wrote to memory of 928 4844 7B5A.tmp 102 PID 4844 wrote to memory of 928 4844 7B5A.tmp 102 PID 928 wrote to memory of 3204 928 7C44.tmp 103 PID 928 wrote to memory of 3204 928 7C44.tmp 103 PID 928 wrote to memory of 3204 928 7C44.tmp 103 PID 3204 wrote to memory of 3300 3204 7D00.tmp 104 PID 3204 wrote to memory of 3300 3204 7D00.tmp 104 PID 3204 wrote to memory of 3300 3204 7D00.tmp 104 PID 3300 wrote to memory of 4524 3300 7DEA.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_1a50754d2035b1baadc5d27d412139eb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_1a50754d2035b1baadc5d27d412139eb_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"23⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"24⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"25⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"26⤵
- Executes dropped EXE
PID:572 -
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"27⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"28⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"29⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"30⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"31⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"32⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"33⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"34⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"35⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"36⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"37⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"38⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"39⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"40⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"41⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"42⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"43⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"44⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"45⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"46⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"47⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"48⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"49⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"50⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"51⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"52⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"53⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"54⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"55⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"56⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"57⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"58⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"59⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"60⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"61⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"62⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"63⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"64⤵
- Executes dropped EXE
PID:784 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"65⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"66⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"67⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"68⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"69⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"70⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"71⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"72⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"73⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"74⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"75⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"76⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"77⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"78⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"79⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"80⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"81⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"82⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"83⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"84⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"85⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"86⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"87⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"88⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"89⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"90⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"91⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"92⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"93⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"94⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"95⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"96⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"97⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"98⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"99⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"100⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"101⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"102⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"103⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"104⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"105⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"106⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"107⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"108⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"109⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"110⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"111⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"112⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"113⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"114⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"115⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"116⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"117⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"118⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"119⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"120⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"121⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"122⤵PID:4952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-