Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18-02-2024 07:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-18_c4456c411132d4bbfc3bd16cd091e7ff_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-18_c4456c411132d4bbfc3bd16cd091e7ff_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-18_c4456c411132d4bbfc3bd16cd091e7ff_mafia.exe
-
Size
488KB
-
MD5
c4456c411132d4bbfc3bd16cd091e7ff
-
SHA1
54f29f12047895823bd99a3e02bae662d0d0fd13
-
SHA256
98d2d8c6a2f7397a910ef93b0fe4d0b8715367a25e26198bbfc28c1650020646
-
SHA512
35f817fdfa869fc7f2d1aed6dc7975478d2b699aab47fff41e1c2864cad8dfa12964c5f1673598d2b97cf9605778acba1ad2705e68a5c655fb497eb472fe0aaa
-
SSDEEP
12288:/U5rCOTeiDwdwTLiFq+Xtr2FS8JB4zNZ:/UQOJD7TuhX52Fhz8N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 212 6F25.tmp 4800 6FD1.tmp 3180 70AC.tmp 4556 71C5.tmp 3016 7280.tmp 2680 734B.tmp 1860 7407.tmp 916 74D2.tmp 636 75AD.tmp 4252 7668.tmp 4924 7733.tmp 4648 77EF.tmp 2812 78F9.tmp 1336 79D3.tmp 4032 7A7F.tmp 4744 7B2B.tmp 2216 7C35.tmp 4768 7CD1.tmp 1256 7E86.tmp 3504 7F80.tmp 4000 806B.tmp 1252 8126.tmp 5036 8211.tmp 2420 82DC.tmp 2496 83C6.tmp 1896 84B1.tmp 4588 856C.tmp 3812 8637.tmp 3680 86D3.tmp 1224 87CD.tmp 3900 8889.tmp 5104 8944.tmp 3260 89F0.tmp 3612 8A6D.tmp 456 8AFA.tmp 2028 8BA6.tmp 2244 8C42.tmp 2264 8CCF.tmp 2416 8D5B.tmp 3632 8DD8.tmp 2328 8E65.tmp 2168 8F4F.tmp 1764 8FDC.tmp 2288 9069.tmp 4024 90C6.tmp 3388 9124.tmp 4312 9191.tmp 4640 91FF.tmp 2980 92BA.tmp 2884 9347.tmp 3720 93E3.tmp 4456 9470.tmp 3920 94DD.tmp 4856 955A.tmp 2396 95C8.tmp 2472 9654.tmp 2016 96D1.tmp 1620 974E.tmp 3008 980A.tmp 1504 98A6.tmp 1932 9942.tmp 4592 99EE.tmp 1904 9A7B.tmp 5028 9B17.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 452 wrote to memory of 212 452 2024-02-18_c4456c411132d4bbfc3bd16cd091e7ff_mafia.exe 79 PID 452 wrote to memory of 212 452 2024-02-18_c4456c411132d4bbfc3bd16cd091e7ff_mafia.exe 79 PID 452 wrote to memory of 212 452 2024-02-18_c4456c411132d4bbfc3bd16cd091e7ff_mafia.exe 79 PID 212 wrote to memory of 4800 212 6F25.tmp 80 PID 212 wrote to memory of 4800 212 6F25.tmp 80 PID 212 wrote to memory of 4800 212 6F25.tmp 80 PID 4800 wrote to memory of 3180 4800 6FD1.tmp 81 PID 4800 wrote to memory of 3180 4800 6FD1.tmp 81 PID 4800 wrote to memory of 3180 4800 6FD1.tmp 81 PID 3180 wrote to memory of 4556 3180 70AC.tmp 82 PID 3180 wrote to memory of 4556 3180 70AC.tmp 82 PID 3180 wrote to memory of 4556 3180 70AC.tmp 82 PID 4556 wrote to memory of 3016 4556 71C5.tmp 83 PID 4556 wrote to memory of 3016 4556 71C5.tmp 83 PID 4556 wrote to memory of 3016 4556 71C5.tmp 83 PID 3016 wrote to memory of 2680 3016 7280.tmp 84 PID 3016 wrote to memory of 2680 3016 7280.tmp 84 PID 3016 wrote to memory of 2680 3016 7280.tmp 84 PID 2680 wrote to memory of 1860 2680 734B.tmp 85 PID 2680 wrote to memory of 1860 2680 734B.tmp 85 PID 2680 wrote to memory of 1860 2680 734B.tmp 85 PID 1860 wrote to memory of 916 1860 7407.tmp 86 PID 1860 wrote to memory of 916 1860 7407.tmp 86 PID 1860 wrote to memory of 916 1860 7407.tmp 86 PID 916 wrote to memory of 636 916 74D2.tmp 87 PID 916 wrote to memory of 636 916 74D2.tmp 87 PID 916 wrote to memory of 636 916 74D2.tmp 87 PID 636 wrote to memory of 4252 636 75AD.tmp 88 PID 636 wrote to memory of 4252 636 75AD.tmp 88 PID 636 wrote to memory of 4252 636 75AD.tmp 88 PID 4252 wrote to memory of 4924 4252 7668.tmp 89 PID 4252 wrote to memory of 4924 4252 7668.tmp 89 PID 4252 wrote to memory of 4924 4252 7668.tmp 89 PID 4924 wrote to memory of 4648 4924 7733.tmp 90 PID 4924 wrote to memory of 4648 4924 7733.tmp 90 PID 4924 wrote to memory of 4648 4924 7733.tmp 90 PID 4648 wrote to memory of 2812 4648 77EF.tmp 92 PID 4648 wrote to memory of 2812 4648 77EF.tmp 92 PID 4648 wrote to memory of 2812 4648 77EF.tmp 92 PID 2812 wrote to memory of 1336 2812 78F9.tmp 93 PID 2812 wrote to memory of 1336 2812 78F9.tmp 93 PID 2812 wrote to memory of 1336 2812 78F9.tmp 93 PID 1336 wrote to memory of 4032 1336 79D3.tmp 94 PID 1336 wrote to memory of 4032 1336 79D3.tmp 94 PID 1336 wrote to memory of 4032 1336 79D3.tmp 94 PID 4032 wrote to memory of 4744 4032 7A7F.tmp 95 PID 4032 wrote to memory of 4744 4032 7A7F.tmp 95 PID 4032 wrote to memory of 4744 4032 7A7F.tmp 95 PID 4744 wrote to memory of 2216 4744 7B2B.tmp 96 PID 4744 wrote to memory of 2216 4744 7B2B.tmp 96 PID 4744 wrote to memory of 2216 4744 7B2B.tmp 96 PID 2216 wrote to memory of 4768 2216 7C35.tmp 97 PID 2216 wrote to memory of 4768 2216 7C35.tmp 97 PID 2216 wrote to memory of 4768 2216 7C35.tmp 97 PID 4768 wrote to memory of 1256 4768 7CD1.tmp 98 PID 4768 wrote to memory of 1256 4768 7CD1.tmp 98 PID 4768 wrote to memory of 1256 4768 7CD1.tmp 98 PID 1256 wrote to memory of 3504 1256 7E86.tmp 99 PID 1256 wrote to memory of 3504 1256 7E86.tmp 99 PID 1256 wrote to memory of 3504 1256 7E86.tmp 99 PID 3504 wrote to memory of 4000 3504 7F80.tmp 100 PID 3504 wrote to memory of 4000 3504 7F80.tmp 100 PID 3504 wrote to memory of 4000 3504 7F80.tmp 100 PID 4000 wrote to memory of 1252 4000 806B.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_c4456c411132d4bbfc3bd16cd091e7ff_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_c4456c411132d4bbfc3bd16cd091e7ff_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"23⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"24⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"25⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"26⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"27⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\856C.tmp"C:\Users\Admin\AppData\Local\Temp\856C.tmp"28⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"29⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"30⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"31⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"32⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"33⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"34⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"35⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"36⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"37⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"38⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"39⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"40⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"41⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"42⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"43⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"44⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"45⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"46⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"47⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"48⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"49⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"50⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"51⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"52⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"53⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"54⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"55⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"56⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"57⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"58⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"59⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"60⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"61⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"62⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"63⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"64⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"65⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"66⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"67⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"68⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"69⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"70⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"71⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"72⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"73⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"74⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"75⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"76⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"77⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"78⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"79⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"80⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"81⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"82⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"83⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"84⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"85⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"86⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"87⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"88⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"89⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"90⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"91⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"92⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"93⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"94⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"95⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"96⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"97⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"98⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"99⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"100⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"101⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"102⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"103⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"104⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"105⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"106⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"107⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"108⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"109⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"110⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"111⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"112⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"113⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"114⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"115⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"116⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"117⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"118⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"119⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"120⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"121⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"122⤵PID:2016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-