Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 16:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-06_fceed5b3d69ab2feb321615f96c0f2d3_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-06_fceed5b3d69ab2feb321615f96c0f2d3_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-03-06_fceed5b3d69ab2feb321615f96c0f2d3_mafia.exe
-
Size
486KB
-
MD5
fceed5b3d69ab2feb321615f96c0f2d3
-
SHA1
d5db556f1a65b5cfa6ec4df7f1b78ebe362b456f
-
SHA256
bf746c0f0f70c4952444096c6903375be65a681c30c0672e68468d15db54a0aa
-
SHA512
c8d4813cdcc395311044403da8e6799ce525aeaf96d2d0a1b2333f62af1ed2c37ae016d1f389ec97b1e3f1f4400b7a8ec6ce1fbbf9e6e3f68b10b3316a1aaa7b
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7/UEGQ30+J3YYsH9JFZdSQ+E2kcYH0KKwfFsz:/U5rCOTeiD/UEhBJ3PezYdS0KsNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2216 7A70.tmp 4004 7B2B.tmp 4436 7BD7.tmp 4056 7CB2.tmp 4896 7D5E.tmp 3616 7E09.tmp 1620 7E96.tmp 1540 7F42.tmp 2344 7FFD.tmp 4496 809A.tmp 1680 8165.tmp 456 8220.tmp 224 82CC.tmp 3932 8397.tmp 3152 8424.tmp 3160 84C0.tmp 5032 855C.tmp 1108 8618.tmp 3052 8722.tmp 4420 87AE.tmp 3964 882B.tmp 2272 8925.tmp 964 8A00.tmp 3272 8A9C.tmp 4040 8B77.tmp 4968 8C13.tmp 3824 8D0D.tmp 4576 8D8A.tmp 5108 8E26.tmp 3200 8F11.tmp 1636 8F9D.tmp 3560 9088.tmp 3024 9191.tmp 4564 91FF.tmp 3920 928B.tmp 3952 9308.tmp 1076 9385.tmp 4368 9412.tmp 3996 948F.tmp 4572 951C.tmp 2316 95B8.tmp 4740 9635.tmp 2324 96C2.tmp 2972 974E.tmp 2368 97CB.tmp 5028 9858.tmp 5024 98D5.tmp 2960 9971.tmp 4896 99FE.tmp 4916 9A6B.tmp 3212 9AF8.tmp 3700 9B75.tmp 1116 9C11.tmp 4580 9C7E.tmp 1792 9CFB.tmp 3252 9D88.tmp 3944 9E53.tmp 4232 9EE0.tmp 4984 9F6C.tmp 456 A009.tmp 224 A0C4.tmp 1040 A151.tmp 4688 A1ED.tmp 3832 A289.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3176 wrote to memory of 2216 3176 2024-03-06_fceed5b3d69ab2feb321615f96c0f2d3_mafia.exe 88 PID 3176 wrote to memory of 2216 3176 2024-03-06_fceed5b3d69ab2feb321615f96c0f2d3_mafia.exe 88 PID 3176 wrote to memory of 2216 3176 2024-03-06_fceed5b3d69ab2feb321615f96c0f2d3_mafia.exe 88 PID 2216 wrote to memory of 4004 2216 7A70.tmp 89 PID 2216 wrote to memory of 4004 2216 7A70.tmp 89 PID 2216 wrote to memory of 4004 2216 7A70.tmp 89 PID 4004 wrote to memory of 4436 4004 7B2B.tmp 91 PID 4004 wrote to memory of 4436 4004 7B2B.tmp 91 PID 4004 wrote to memory of 4436 4004 7B2B.tmp 91 PID 4436 wrote to memory of 4056 4436 7BD7.tmp 92 PID 4436 wrote to memory of 4056 4436 7BD7.tmp 92 PID 4436 wrote to memory of 4056 4436 7BD7.tmp 92 PID 4056 wrote to memory of 4896 4056 7CB2.tmp 93 PID 4056 wrote to memory of 4896 4056 7CB2.tmp 93 PID 4056 wrote to memory of 4896 4056 7CB2.tmp 93 PID 4896 wrote to memory of 3616 4896 7D5E.tmp 95 PID 4896 wrote to memory of 3616 4896 7D5E.tmp 95 PID 4896 wrote to memory of 3616 4896 7D5E.tmp 95 PID 3616 wrote to memory of 1620 3616 7E09.tmp 96 PID 3616 wrote to memory of 1620 3616 7E09.tmp 96 PID 3616 wrote to memory of 1620 3616 7E09.tmp 96 PID 1620 wrote to memory of 1540 1620 7E96.tmp 97 PID 1620 wrote to memory of 1540 1620 7E96.tmp 97 PID 1620 wrote to memory of 1540 1620 7E96.tmp 97 PID 1540 wrote to memory of 2344 1540 7F42.tmp 98 PID 1540 wrote to memory of 2344 1540 7F42.tmp 98 PID 1540 wrote to memory of 2344 1540 7F42.tmp 98 PID 2344 wrote to memory of 4496 2344 7FFD.tmp 99 PID 2344 wrote to memory of 4496 2344 7FFD.tmp 99 PID 2344 wrote to memory of 4496 2344 7FFD.tmp 99 PID 4496 wrote to memory of 1680 4496 809A.tmp 100 PID 4496 wrote to memory of 1680 4496 809A.tmp 100 PID 4496 wrote to memory of 1680 4496 809A.tmp 100 PID 1680 wrote to memory of 456 1680 8165.tmp 101 PID 1680 wrote to memory of 456 1680 8165.tmp 101 PID 1680 wrote to memory of 456 1680 8165.tmp 101 PID 456 wrote to memory of 224 456 8220.tmp 102 PID 456 wrote to memory of 224 456 8220.tmp 102 PID 456 wrote to memory of 224 456 8220.tmp 102 PID 224 wrote to memory of 3932 224 82CC.tmp 103 PID 224 wrote to memory of 3932 224 82CC.tmp 103 PID 224 wrote to memory of 3932 224 82CC.tmp 103 PID 3932 wrote to memory of 3152 3932 8397.tmp 104 PID 3932 wrote to memory of 3152 3932 8397.tmp 104 PID 3932 wrote to memory of 3152 3932 8397.tmp 104 PID 3152 wrote to memory of 3160 3152 8424.tmp 105 PID 3152 wrote to memory of 3160 3152 8424.tmp 105 PID 3152 wrote to memory of 3160 3152 8424.tmp 105 PID 3160 wrote to memory of 5032 3160 84C0.tmp 106 PID 3160 wrote to memory of 5032 3160 84C0.tmp 106 PID 3160 wrote to memory of 5032 3160 84C0.tmp 106 PID 5032 wrote to memory of 1108 5032 855C.tmp 107 PID 5032 wrote to memory of 1108 5032 855C.tmp 107 PID 5032 wrote to memory of 1108 5032 855C.tmp 107 PID 1108 wrote to memory of 3052 1108 8618.tmp 108 PID 1108 wrote to memory of 3052 1108 8618.tmp 108 PID 1108 wrote to memory of 3052 1108 8618.tmp 108 PID 3052 wrote to memory of 4420 3052 8722.tmp 109 PID 3052 wrote to memory of 4420 3052 8722.tmp 109 PID 3052 wrote to memory of 4420 3052 8722.tmp 109 PID 4420 wrote to memory of 3964 4420 87AE.tmp 110 PID 4420 wrote to memory of 3964 4420 87AE.tmp 110 PID 4420 wrote to memory of 3964 4420 87AE.tmp 110 PID 3964 wrote to memory of 2272 3964 882B.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_fceed5b3d69ab2feb321615f96c0f2d3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_fceed5b3d69ab2feb321615f96c0f2d3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"23⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"24⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"25⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"26⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"27⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"28⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"29⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"30⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"31⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"32⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"33⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"34⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"35⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"36⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"37⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"38⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"39⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"40⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"41⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"42⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"43⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"44⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"45⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"46⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"47⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"48⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"49⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"50⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"51⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"52⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"53⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"54⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"55⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"56⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"57⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"58⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"59⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"60⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"61⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"62⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"63⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"64⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"65⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"66⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"67⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"68⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"69⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"70⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"71⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"72⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"73⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"74⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"75⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"76⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"77⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"78⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"79⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"80⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"81⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"82⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"83⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"84⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"85⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"86⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"87⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"88⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"89⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"90⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"91⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"92⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"93⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"94⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"95⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"96⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"97⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"98⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\B585.tmp"C:\Users\Admin\AppData\Local\Temp\B585.tmp"99⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"100⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"101⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"102⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"103⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"104⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"105⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"106⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"107⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"108⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"109⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"110⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"111⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"112⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"113⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"114⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"115⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"116⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"117⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"118⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"119⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"120⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"121⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"122⤵PID:3584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-