Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2024 14:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe
-
Size
488KB
-
MD5
80105a437c1233aa6143af2a1f7f9253
-
SHA1
54550d8e30971aab1fc56b46905266984e8a2a52
-
SHA256
45ff2705e7afb533172a22e11994a29e155e8c84fceb49db0c6370e73fbb1800
-
SHA512
1a5a6014cc86c0c878dc1528067d7b5f2e9d9ae4222f8a57df4025eabb7c4ff1f9b855f7cc55537e2724495da347a87741787b461500c6164d9b4f5d69cdab52
-
SSDEEP
12288:/U5rCOTeiDfGYdpZAkmzac777VFaopYNZ:/UQOJDOWPAkt67idN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4928 589F.tmp 1688 593C.tmp 1492 5A07.tmp 840 5AB3.tmp 3192 5B30.tmp 1796 5BCC.tmp 1452 5C39.tmp 5016 5CF5.tmp 3984 5DA1.tmp 1916 5E2D.tmp 1700 5ED9.tmp 3620 5F75.tmp 3468 6021.tmp 4456 610C.tmp 2160 6198.tmp 4460 6244.tmp 708 62F0.tmp 1040 639C.tmp 1512 6457.tmp 3172 6522.tmp 2028 661C.tmp 1964 6716.tmp 1344 67B3.tmp 3144 685F.tmp 1340 690A.tmp 2112 69B6.tmp 3924 6A53.tmp 4472 6B4D.tmp 2672 6C27.tmp 1416 6D12.tmp 5096 6DDD.tmp 4808 6EA8.tmp 1068 6F92.tmp 4476 702F.tmp 744 70AC.tmp 4340 7129.tmp 4276 71C5.tmp 4248 7232.tmp 2976 72AF.tmp 1932 734B.tmp 3708 73D8.tmp 3236 7465.tmp 1308 74F1.tmp 4184 758E.tmp 964 7668.tmp 452 76F5.tmp 212 7782.tmp 1688 781E.tmp 856 78BA.tmp 2368 7976.tmp 840 7A12.tmp 1992 7A8F.tmp 1844 7B0C.tmp 3648 7BA8.tmp 5040 7C25.tmp 2868 7CB2.tmp 4596 7D2F.tmp 1260 7DAC.tmp 3984 7E38.tmp 2428 7EE4.tmp 1592 7F61.tmp 2216 7FEE.tmp 3856 806B.tmp 640 80E8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3852 wrote to memory of 4928 3852 2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe 86 PID 3852 wrote to memory of 4928 3852 2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe 86 PID 3852 wrote to memory of 4928 3852 2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe 86 PID 4928 wrote to memory of 1688 4928 589F.tmp 87 PID 4928 wrote to memory of 1688 4928 589F.tmp 87 PID 4928 wrote to memory of 1688 4928 589F.tmp 87 PID 1688 wrote to memory of 1492 1688 593C.tmp 88 PID 1688 wrote to memory of 1492 1688 593C.tmp 88 PID 1688 wrote to memory of 1492 1688 593C.tmp 88 PID 1492 wrote to memory of 840 1492 5A07.tmp 89 PID 1492 wrote to memory of 840 1492 5A07.tmp 89 PID 1492 wrote to memory of 840 1492 5A07.tmp 89 PID 840 wrote to memory of 3192 840 5AB3.tmp 90 PID 840 wrote to memory of 3192 840 5AB3.tmp 90 PID 840 wrote to memory of 3192 840 5AB3.tmp 90 PID 3192 wrote to memory of 1796 3192 5B30.tmp 91 PID 3192 wrote to memory of 1796 3192 5B30.tmp 91 PID 3192 wrote to memory of 1796 3192 5B30.tmp 91 PID 1796 wrote to memory of 1452 1796 5BCC.tmp 92 PID 1796 wrote to memory of 1452 1796 5BCC.tmp 92 PID 1796 wrote to memory of 1452 1796 5BCC.tmp 92 PID 1452 wrote to memory of 5016 1452 5C39.tmp 93 PID 1452 wrote to memory of 5016 1452 5C39.tmp 93 PID 1452 wrote to memory of 5016 1452 5C39.tmp 93 PID 5016 wrote to memory of 3984 5016 5CF5.tmp 94 PID 5016 wrote to memory of 3984 5016 5CF5.tmp 94 PID 5016 wrote to memory of 3984 5016 5CF5.tmp 94 PID 3984 wrote to memory of 1916 3984 5DA1.tmp 95 PID 3984 wrote to memory of 1916 3984 5DA1.tmp 95 PID 3984 wrote to memory of 1916 3984 5DA1.tmp 95 PID 1916 wrote to memory of 1700 1916 5E2D.tmp 96 PID 1916 wrote to memory of 1700 1916 5E2D.tmp 96 PID 1916 wrote to memory of 1700 1916 5E2D.tmp 96 PID 1700 wrote to memory of 3620 1700 5ED9.tmp 97 PID 1700 wrote to memory of 3620 1700 5ED9.tmp 97 PID 1700 wrote to memory of 3620 1700 5ED9.tmp 97 PID 3620 wrote to memory of 3468 3620 5F75.tmp 98 PID 3620 wrote to memory of 3468 3620 5F75.tmp 98 PID 3620 wrote to memory of 3468 3620 5F75.tmp 98 PID 3468 wrote to memory of 4456 3468 6021.tmp 99 PID 3468 wrote to memory of 4456 3468 6021.tmp 99 PID 3468 wrote to memory of 4456 3468 6021.tmp 99 PID 4456 wrote to memory of 2160 4456 610C.tmp 100 PID 4456 wrote to memory of 2160 4456 610C.tmp 100 PID 4456 wrote to memory of 2160 4456 610C.tmp 100 PID 2160 wrote to memory of 4460 2160 6198.tmp 101 PID 2160 wrote to memory of 4460 2160 6198.tmp 101 PID 2160 wrote to memory of 4460 2160 6198.tmp 101 PID 4460 wrote to memory of 708 4460 6244.tmp 102 PID 4460 wrote to memory of 708 4460 6244.tmp 102 PID 4460 wrote to memory of 708 4460 6244.tmp 102 PID 708 wrote to memory of 1040 708 62F0.tmp 105 PID 708 wrote to memory of 1040 708 62F0.tmp 105 PID 708 wrote to memory of 1040 708 62F0.tmp 105 PID 1040 wrote to memory of 1512 1040 639C.tmp 106 PID 1040 wrote to memory of 1512 1040 639C.tmp 106 PID 1040 wrote to memory of 1512 1040 639C.tmp 106 PID 1512 wrote to memory of 3172 1512 6457.tmp 107 PID 1512 wrote to memory of 3172 1512 6457.tmp 107 PID 1512 wrote to memory of 3172 1512 6457.tmp 107 PID 3172 wrote to memory of 2028 3172 6522.tmp 108 PID 3172 wrote to memory of 2028 3172 6522.tmp 108 PID 3172 wrote to memory of 2028 3172 6522.tmp 108 PID 2028 wrote to memory of 1964 2028 661C.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"23⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"24⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"25⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"26⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"27⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"28⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"29⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"30⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"31⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"32⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"33⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"34⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"35⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"36⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"37⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"38⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"39⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"40⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"41⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"42⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"43⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"44⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"45⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"46⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"47⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"48⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"49⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"50⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"51⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\7A12.tmp"C:\Users\Admin\AppData\Local\Temp\7A12.tmp"52⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"53⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"54⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"55⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"56⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"57⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"58⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"59⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"60⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"61⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"62⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"63⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"64⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"65⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"66⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"67⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"68⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"69⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"70⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"71⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\8472.tmp"C:\Users\Admin\AppData\Local\Temp\8472.tmp"72⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"73⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"74⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"75⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"76⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"77⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"78⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"79⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"80⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"81⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"82⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"83⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"84⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"85⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"86⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"87⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"88⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"89⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"90⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"91⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"92⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"93⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"94⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"95⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"96⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"97⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"98⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"99⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"100⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"101⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"102⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"103⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"104⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"105⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"106⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"107⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"108⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"109⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"110⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"111⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"112⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"113⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"114⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"115⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"116⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"117⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"118⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"119⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"120⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"121⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"122⤵PID:4368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-