Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2024, 02:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-13_83a09239d4c19bf5f70e51effe1b05a7_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-13_83a09239d4c19bf5f70e51effe1b05a7_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-13_83a09239d4c19bf5f70e51effe1b05a7_mafia.exe
-
Size
486KB
-
MD5
83a09239d4c19bf5f70e51effe1b05a7
-
SHA1
84fb6fc5e113b279181730c64bb65a1ae7dd1dcb
-
SHA256
cfd2a4cca8d38009cb3edeb521e8bae6b8fb3d00d8342caff9eb0f6b26053ad0
-
SHA512
693b205919a5bfb5a19e489aa89d3fb27feeab0e798934509dbabcc57d3d97e6df7164398329052c2f1875b1795f8b4cc774e2b90f0477a4aacfb7f4eb99ca26
-
SSDEEP
12288:UU5rCOTeiDzOzgRhgbccrwpCtXKRyV/lF1pNZ:UUQOJDz9/cchCYSF7N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3544 76E5.tmp 1984 782D.tmp 1052 78E9.tmp 1116 7995.tmp 2148 7A60.tmp 2960 7ACD.tmp 1580 7B6A.tmp 2844 7C15.tmp 3108 7CE1.tmp 4780 7D5E.tmp 4556 7DFA.tmp 2192 7E77.tmp 644 7F03.tmp 3288 7F90.tmp 2072 802C.tmp 3128 80E8.tmp 4052 81B3.tmp 4644 824F.tmp 4936 832A.tmp 4596 85CA.tmp 760 86B4.tmp 4748 8760.tmp 3632 880C.tmp 4892 8889.tmp 1168 8906.tmp 1988 89B2.tmp 1572 8A7D.tmp 1348 8B38.tmp 2576 8C04.tmp 3976 8CDE.tmp 1792 8D7B.tmp 1152 8E46.tmp 4088 8F20.tmp 5104 8FCC.tmp 1204 9059.tmp 5080 90F5.tmp 4932 9172.tmp 2304 91FF.tmp 3328 929B.tmp 3216 9337.tmp 1336 93D4.tmp 3324 9460.tmp 440 94ED.tmp 4460 9579.tmp 1944 9625.tmp 224 96D1.tmp 2036 974E.tmp 3124 97DB.tmp 5036 9877.tmp 4860 98F4.tmp 2884 9961.tmp 1208 99EE.tmp 3428 9A8A.tmp 4572 9B17.tmp 4904 9B94.tmp 2812 9C01.tmp 1556 9C7E.tmp 5008 9D0B.tmp 2996 9DA7.tmp 3276 9E34.tmp 352 9EC0.tmp 5012 9F3D.tmp 2924 9FBA.tmp 1536 A057.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2660 wrote to memory of 3544 2660 2024-02-13_83a09239d4c19bf5f70e51effe1b05a7_mafia.exe 84 PID 2660 wrote to memory of 3544 2660 2024-02-13_83a09239d4c19bf5f70e51effe1b05a7_mafia.exe 84 PID 2660 wrote to memory of 3544 2660 2024-02-13_83a09239d4c19bf5f70e51effe1b05a7_mafia.exe 84 PID 3544 wrote to memory of 1984 3544 76E5.tmp 85 PID 3544 wrote to memory of 1984 3544 76E5.tmp 85 PID 3544 wrote to memory of 1984 3544 76E5.tmp 85 PID 1984 wrote to memory of 1052 1984 782D.tmp 86 PID 1984 wrote to memory of 1052 1984 782D.tmp 86 PID 1984 wrote to memory of 1052 1984 782D.tmp 86 PID 1052 wrote to memory of 1116 1052 78E9.tmp 87 PID 1052 wrote to memory of 1116 1052 78E9.tmp 87 PID 1052 wrote to memory of 1116 1052 78E9.tmp 87 PID 1116 wrote to memory of 2148 1116 7995.tmp 88 PID 1116 wrote to memory of 2148 1116 7995.tmp 88 PID 1116 wrote to memory of 2148 1116 7995.tmp 88 PID 2148 wrote to memory of 2960 2148 7A60.tmp 89 PID 2148 wrote to memory of 2960 2148 7A60.tmp 89 PID 2148 wrote to memory of 2960 2148 7A60.tmp 89 PID 2960 wrote to memory of 1580 2960 7ACD.tmp 90 PID 2960 wrote to memory of 1580 2960 7ACD.tmp 90 PID 2960 wrote to memory of 1580 2960 7ACD.tmp 90 PID 1580 wrote to memory of 2844 1580 7B6A.tmp 91 PID 1580 wrote to memory of 2844 1580 7B6A.tmp 91 PID 1580 wrote to memory of 2844 1580 7B6A.tmp 91 PID 2844 wrote to memory of 3108 2844 7C15.tmp 92 PID 2844 wrote to memory of 3108 2844 7C15.tmp 92 PID 2844 wrote to memory of 3108 2844 7C15.tmp 92 PID 3108 wrote to memory of 4780 3108 7CE1.tmp 93 PID 3108 wrote to memory of 4780 3108 7CE1.tmp 93 PID 3108 wrote to memory of 4780 3108 7CE1.tmp 93 PID 4780 wrote to memory of 4556 4780 7D5E.tmp 94 PID 4780 wrote to memory of 4556 4780 7D5E.tmp 94 PID 4780 wrote to memory of 4556 4780 7D5E.tmp 94 PID 4556 wrote to memory of 2192 4556 7DFA.tmp 95 PID 4556 wrote to memory of 2192 4556 7DFA.tmp 95 PID 4556 wrote to memory of 2192 4556 7DFA.tmp 95 PID 2192 wrote to memory of 644 2192 7E77.tmp 96 PID 2192 wrote to memory of 644 2192 7E77.tmp 96 PID 2192 wrote to memory of 644 2192 7E77.tmp 96 PID 644 wrote to memory of 3288 644 7F03.tmp 97 PID 644 wrote to memory of 3288 644 7F03.tmp 97 PID 644 wrote to memory of 3288 644 7F03.tmp 97 PID 3288 wrote to memory of 2072 3288 7F90.tmp 98 PID 3288 wrote to memory of 2072 3288 7F90.tmp 98 PID 3288 wrote to memory of 2072 3288 7F90.tmp 98 PID 2072 wrote to memory of 3128 2072 802C.tmp 99 PID 2072 wrote to memory of 3128 2072 802C.tmp 99 PID 2072 wrote to memory of 3128 2072 802C.tmp 99 PID 3128 wrote to memory of 4052 3128 80E8.tmp 100 PID 3128 wrote to memory of 4052 3128 80E8.tmp 100 PID 3128 wrote to memory of 4052 3128 80E8.tmp 100 PID 4052 wrote to memory of 4644 4052 81B3.tmp 101 PID 4052 wrote to memory of 4644 4052 81B3.tmp 101 PID 4052 wrote to memory of 4644 4052 81B3.tmp 101 PID 4644 wrote to memory of 4936 4644 824F.tmp 102 PID 4644 wrote to memory of 4936 4644 824F.tmp 102 PID 4644 wrote to memory of 4936 4644 824F.tmp 102 PID 4936 wrote to memory of 4596 4936 832A.tmp 103 PID 4936 wrote to memory of 4596 4936 832A.tmp 103 PID 4936 wrote to memory of 4596 4936 832A.tmp 103 PID 4596 wrote to memory of 760 4596 85CA.tmp 104 PID 4596 wrote to memory of 760 4596 85CA.tmp 104 PID 4596 wrote to memory of 760 4596 85CA.tmp 104 PID 760 wrote to memory of 4748 760 86B4.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_83a09239d4c19bf5f70e51effe1b05a7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_83a09239d4c19bf5f70e51effe1b05a7_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"23⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"24⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"25⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"26⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"27⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"28⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"29⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"30⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"31⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"32⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"33⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"34⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"35⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"36⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"37⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"38⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"39⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"40⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"41⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"42⤵
- Executes dropped EXE
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"43⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"44⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"45⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"46⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"47⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"48⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"49⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"50⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"51⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"52⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"53⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"54⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"55⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"56⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"57⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"58⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"59⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"60⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"61⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"62⤵
- Executes dropped EXE
PID:352 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"63⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"64⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"65⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"66⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"67⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"68⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"69⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"70⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"71⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"72⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"73⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"74⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"75⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"76⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"77⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"78⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"79⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"80⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"81⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"82⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"83⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"84⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"85⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"86⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"87⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"88⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"89⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"90⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"91⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"92⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"93⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"94⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"95⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"96⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"97⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"98⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"99⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"100⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"101⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"102⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"103⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"104⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"105⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"106⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"107⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"108⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"109⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"110⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"111⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\B798.tmp"C:\Users\Admin\AppData\Local\Temp\B798.tmp"112⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"113⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"114⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"115⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"116⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"117⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"118⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"119⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"120⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"121⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"122⤵PID:4520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-