Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-02-2024 13:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-19_cb1f1f73363c2d4db2d5aac61a868581_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-19_cb1f1f73363c2d4db2d5aac61a868581_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-19_cb1f1f73363c2d4db2d5aac61a868581_mafia.exe
-
Size
527KB
-
MD5
cb1f1f73363c2d4db2d5aac61a868581
-
SHA1
e3367e6cba9bed5fb2c24853a42c5f5fc4ec1430
-
SHA256
b0f7338553c295b371fc6301459e8d97abe00b028c0ce13b6cfe1d2923d75cc6
-
SHA512
5b0830cc444476eb2b5c605640f09539c4fe33a43b998f5bf6f9e2ec3db881abae7394e1686d67055bb9f056650ac7b138582b168284a4b67b102a3079a42953
-
SSDEEP
12288:fU5rCOTeidPmzmFzO9SGNnOmFiUoeKlObAhmDZu:fUQOJdPYGO9BNOub8mDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2100 7B6A.tmp 3968 7C06.tmp 1696 7CB2.tmp 4020 7D9C.tmp 4228 7E38.tmp 2532 7EE4.tmp 4448 7F80.tmp 4212 805B.tmp 5100 8155.tmp 4960 8201.tmp 4576 82CC.tmp 1272 83A7.tmp 2844 8482.tmp 1664 851E.tmp 4300 8628.tmp 1976 8731.tmp 564 87CD.tmp 3372 8879.tmp 1172 8925.tmp 4956 8A00.tmp 224 8B29.tmp 2760 8BF4.tmp 1240 8CCF.tmp 988 8DB9.tmp 828 8E65.tmp 2112 8F20.tmp 3480 8FCC.tmp 4816 9078.tmp 2348 9105.tmp 2268 91EF.tmp 4764 926C.tmp 4368 9347.tmp 4780 9441.tmp 5084 94BE.tmp 4784 955A.tmp 2788 95C8.tmp 2968 9635.tmp 3872 9693.tmp 4580 971F.tmp 4836 97AC.tmp 5032 9819.tmp 3800 98A6.tmp 3128 9933.tmp 5116 99CF.tmp 1992 9A6B.tmp 4748 9AF8.tmp 5024 9B65.tmp 3112 9BD2.tmp 3416 9C4F.tmp 3032 9CAD.tmp 220 9D1B.tmp 3928 9D88.tmp 4624 9E24.tmp 2052 9EE0.tmp 2156 9F5D.tmp 764 9FCA.tmp 4752 A028.tmp 3888 A0B4.tmp 2276 A122.tmp 2596 A19F.tmp 5100 A21C.tmp 3036 A289.tmp 2888 A316.tmp 2892 A383.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 2100 2308 2024-02-19_cb1f1f73363c2d4db2d5aac61a868581_mafia.exe 83 PID 2308 wrote to memory of 2100 2308 2024-02-19_cb1f1f73363c2d4db2d5aac61a868581_mafia.exe 83 PID 2308 wrote to memory of 2100 2308 2024-02-19_cb1f1f73363c2d4db2d5aac61a868581_mafia.exe 83 PID 2100 wrote to memory of 3968 2100 7B6A.tmp 84 PID 2100 wrote to memory of 3968 2100 7B6A.tmp 84 PID 2100 wrote to memory of 3968 2100 7B6A.tmp 84 PID 3968 wrote to memory of 1696 3968 7C06.tmp 85 PID 3968 wrote to memory of 1696 3968 7C06.tmp 85 PID 3968 wrote to memory of 1696 3968 7C06.tmp 85 PID 1696 wrote to memory of 4020 1696 7CB2.tmp 86 PID 1696 wrote to memory of 4020 1696 7CB2.tmp 86 PID 1696 wrote to memory of 4020 1696 7CB2.tmp 86 PID 4020 wrote to memory of 4228 4020 7D9C.tmp 87 PID 4020 wrote to memory of 4228 4020 7D9C.tmp 87 PID 4020 wrote to memory of 4228 4020 7D9C.tmp 87 PID 4228 wrote to memory of 2532 4228 7E38.tmp 88 PID 4228 wrote to memory of 2532 4228 7E38.tmp 88 PID 4228 wrote to memory of 2532 4228 7E38.tmp 88 PID 2532 wrote to memory of 4448 2532 7EE4.tmp 89 PID 2532 wrote to memory of 4448 2532 7EE4.tmp 89 PID 2532 wrote to memory of 4448 2532 7EE4.tmp 89 PID 4448 wrote to memory of 4212 4448 7F80.tmp 90 PID 4448 wrote to memory of 4212 4448 7F80.tmp 90 PID 4448 wrote to memory of 4212 4448 7F80.tmp 90 PID 4212 wrote to memory of 5100 4212 805B.tmp 91 PID 4212 wrote to memory of 5100 4212 805B.tmp 91 PID 4212 wrote to memory of 5100 4212 805B.tmp 91 PID 5100 wrote to memory of 4960 5100 8155.tmp 92 PID 5100 wrote to memory of 4960 5100 8155.tmp 92 PID 5100 wrote to memory of 4960 5100 8155.tmp 92 PID 4960 wrote to memory of 4576 4960 8201.tmp 93 PID 4960 wrote to memory of 4576 4960 8201.tmp 93 PID 4960 wrote to memory of 4576 4960 8201.tmp 93 PID 4576 wrote to memory of 1272 4576 82CC.tmp 94 PID 4576 wrote to memory of 1272 4576 82CC.tmp 94 PID 4576 wrote to memory of 1272 4576 82CC.tmp 94 PID 1272 wrote to memory of 2844 1272 83A7.tmp 95 PID 1272 wrote to memory of 2844 1272 83A7.tmp 95 PID 1272 wrote to memory of 2844 1272 83A7.tmp 95 PID 2844 wrote to memory of 1664 2844 8482.tmp 96 PID 2844 wrote to memory of 1664 2844 8482.tmp 96 PID 2844 wrote to memory of 1664 2844 8482.tmp 96 PID 1664 wrote to memory of 4300 1664 851E.tmp 97 PID 1664 wrote to memory of 4300 1664 851E.tmp 97 PID 1664 wrote to memory of 4300 1664 851E.tmp 97 PID 4300 wrote to memory of 1976 4300 8628.tmp 98 PID 4300 wrote to memory of 1976 4300 8628.tmp 98 PID 4300 wrote to memory of 1976 4300 8628.tmp 98 PID 1976 wrote to memory of 564 1976 8731.tmp 99 PID 1976 wrote to memory of 564 1976 8731.tmp 99 PID 1976 wrote to memory of 564 1976 8731.tmp 99 PID 564 wrote to memory of 3372 564 87CD.tmp 100 PID 564 wrote to memory of 3372 564 87CD.tmp 100 PID 564 wrote to memory of 3372 564 87CD.tmp 100 PID 3372 wrote to memory of 1172 3372 8879.tmp 101 PID 3372 wrote to memory of 1172 3372 8879.tmp 101 PID 3372 wrote to memory of 1172 3372 8879.tmp 101 PID 1172 wrote to memory of 4956 1172 8925.tmp 102 PID 1172 wrote to memory of 4956 1172 8925.tmp 102 PID 1172 wrote to memory of 4956 1172 8925.tmp 102 PID 4956 wrote to memory of 224 4956 8A00.tmp 103 PID 4956 wrote to memory of 224 4956 8A00.tmp 103 PID 4956 wrote to memory of 224 4956 8A00.tmp 103 PID 224 wrote to memory of 2760 224 8B29.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_cb1f1f73363c2d4db2d5aac61a868581_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_cb1f1f73363c2d4db2d5aac61a868581_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"23⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"24⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"25⤵
- Executes dropped EXE
PID:988 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"26⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"27⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"28⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"29⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"30⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"31⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"32⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"33⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"34⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"35⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"36⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"37⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"38⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"39⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"40⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"41⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"42⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"43⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"44⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"45⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"46⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"47⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"48⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"49⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"50⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"51⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"52⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"53⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"54⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"55⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"56⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"57⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"58⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"59⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"60⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"61⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"62⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"63⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"64⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"65⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"66⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"67⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"68⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"69⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"70⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"71⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"72⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"73⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"74⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"75⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"76⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"77⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"78⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"79⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"80⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"81⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"82⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"83⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"84⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"85⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"86⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"87⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"88⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"89⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"90⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"91⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"92⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"93⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"94⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"95⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"96⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"97⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"98⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"99⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"100⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"101⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"102⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"103⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"104⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"105⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"106⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"107⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"108⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"109⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"110⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"111⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"112⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"113⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"114⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"115⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"116⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"117⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"118⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"119⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"120⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"121⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"122⤵PID:4536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-