Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12-05-2024 20:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-11_1da99ca3d4d2f43363015913cac3789e_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-11_1da99ca3d4d2f43363015913cac3789e_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-11_1da99ca3d4d2f43363015913cac3789e_mafia.exe
-
Size
541KB
-
MD5
1da99ca3d4d2f43363015913cac3789e
-
SHA1
756eed8dc8f8b5262cbe22c3090f457d85be349a
-
SHA256
cdf379784a964509613ba11fe12211c7196abe85851f6a903c4d202ffecec34b
-
SHA512
734a20d3db018c453c95704d85f852af94859b7fa61482bb231d63e32705dd762df9ee8430de8795a90e669cc7e58b1a6c8ce44533139731df026dca0cbbb55f
-
SSDEEP
12288:UU5rCOTeifYRaSNx4TJQzG+4KDClvCbx4crZa73ctO:UUQOJfD8DClvCbOcrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1628 8B19.tmp 3292 8C23.tmp 1448 8CA0.tmp 4516 8D2C.tmp 3952 8DC9.tmp 5012 8E65.tmp 1852 8ED2.tmp 712 8F7E.tmp 5072 900B.tmp 3220 9088.tmp 1664 9105.tmp 3164 91B1.tmp 2352 926C.tmp 4488 92E9.tmp 3856 9347.tmp 2064 93B4.tmp 4116 9431.tmp 1812 94AE.tmp 3696 950C.tmp 2160 9579.tmp 3140 9616.tmp 2016 96D1.tmp 1588 974E.tmp 3548 97FA.tmp 3484 9867.tmp 4408 98E4.tmp 1188 9952.tmp 4168 99B0.tmp 3188 9A0D.tmp 2300 9A9A.tmp 2772 9B36.tmp 4008 9BB3.tmp 4160 9C30.tmp 1720 9C8E.tmp 3460 9CEC.tmp 3604 9D3A.tmp 3636 9DA7.tmp 3568 9E05.tmp 412 9E72.tmp 4152 9ED0.tmp 5108 9F3D.tmp 496 9F9B.tmp 1348 A009.tmp 4792 A057.tmp 1916 A0A5.tmp 4308 A112.tmp 1648 A160.tmp 1396 A1CE.tmp 2992 A22B.tmp 208 A299.tmp 2116 A306.tmp 1980 A374.tmp 216 A3C2.tmp 656 A41F.tmp 1208 A46E.tmp 4016 A4CB.tmp 2724 A519.tmp 5064 A568.tmp 4264 A5B6.tmp 2740 A613.tmp 4808 A662.tmp 712 A6BF.tmp 5076 A71D.tmp 2068 A78A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2992 wrote to memory of 1628 2992 2024-05-11_1da99ca3d4d2f43363015913cac3789e_mafia.exe 82 PID 2992 wrote to memory of 1628 2992 2024-05-11_1da99ca3d4d2f43363015913cac3789e_mafia.exe 82 PID 2992 wrote to memory of 1628 2992 2024-05-11_1da99ca3d4d2f43363015913cac3789e_mafia.exe 82 PID 1628 wrote to memory of 3292 1628 8B19.tmp 83 PID 1628 wrote to memory of 3292 1628 8B19.tmp 83 PID 1628 wrote to memory of 3292 1628 8B19.tmp 83 PID 3292 wrote to memory of 1448 3292 8C23.tmp 85 PID 3292 wrote to memory of 1448 3292 8C23.tmp 85 PID 3292 wrote to memory of 1448 3292 8C23.tmp 85 PID 1448 wrote to memory of 4516 1448 8CA0.tmp 86 PID 1448 wrote to memory of 4516 1448 8CA0.tmp 86 PID 1448 wrote to memory of 4516 1448 8CA0.tmp 86 PID 4516 wrote to memory of 3952 4516 8D2C.tmp 88 PID 4516 wrote to memory of 3952 4516 8D2C.tmp 88 PID 4516 wrote to memory of 3952 4516 8D2C.tmp 88 PID 3952 wrote to memory of 5012 3952 8DC9.tmp 89 PID 3952 wrote to memory of 5012 3952 8DC9.tmp 89 PID 3952 wrote to memory of 5012 3952 8DC9.tmp 89 PID 5012 wrote to memory of 1852 5012 8E65.tmp 91 PID 5012 wrote to memory of 1852 5012 8E65.tmp 91 PID 5012 wrote to memory of 1852 5012 8E65.tmp 91 PID 1852 wrote to memory of 712 1852 8ED2.tmp 92 PID 1852 wrote to memory of 712 1852 8ED2.tmp 92 PID 1852 wrote to memory of 712 1852 8ED2.tmp 92 PID 712 wrote to memory of 5072 712 8F7E.tmp 93 PID 712 wrote to memory of 5072 712 8F7E.tmp 93 PID 712 wrote to memory of 5072 712 8F7E.tmp 93 PID 5072 wrote to memory of 3220 5072 900B.tmp 94 PID 5072 wrote to memory of 3220 5072 900B.tmp 94 PID 5072 wrote to memory of 3220 5072 900B.tmp 94 PID 3220 wrote to memory of 1664 3220 9088.tmp 95 PID 3220 wrote to memory of 1664 3220 9088.tmp 95 PID 3220 wrote to memory of 1664 3220 9088.tmp 95 PID 1664 wrote to memory of 3164 1664 9105.tmp 96 PID 1664 wrote to memory of 3164 1664 9105.tmp 96 PID 1664 wrote to memory of 3164 1664 9105.tmp 96 PID 3164 wrote to memory of 2352 3164 91B1.tmp 97 PID 3164 wrote to memory of 2352 3164 91B1.tmp 97 PID 3164 wrote to memory of 2352 3164 91B1.tmp 97 PID 2352 wrote to memory of 4488 2352 926C.tmp 98 PID 2352 wrote to memory of 4488 2352 926C.tmp 98 PID 2352 wrote to memory of 4488 2352 926C.tmp 98 PID 4488 wrote to memory of 3856 4488 92E9.tmp 99 PID 4488 wrote to memory of 3856 4488 92E9.tmp 99 PID 4488 wrote to memory of 3856 4488 92E9.tmp 99 PID 3856 wrote to memory of 2064 3856 9347.tmp 101 PID 3856 wrote to memory of 2064 3856 9347.tmp 101 PID 3856 wrote to memory of 2064 3856 9347.tmp 101 PID 2064 wrote to memory of 4116 2064 93B4.tmp 102 PID 2064 wrote to memory of 4116 2064 93B4.tmp 102 PID 2064 wrote to memory of 4116 2064 93B4.tmp 102 PID 4116 wrote to memory of 1812 4116 9431.tmp 103 PID 4116 wrote to memory of 1812 4116 9431.tmp 103 PID 4116 wrote to memory of 1812 4116 9431.tmp 103 PID 1812 wrote to memory of 3696 1812 94AE.tmp 104 PID 1812 wrote to memory of 3696 1812 94AE.tmp 104 PID 1812 wrote to memory of 3696 1812 94AE.tmp 104 PID 3696 wrote to memory of 2160 3696 950C.tmp 105 PID 3696 wrote to memory of 2160 3696 950C.tmp 105 PID 3696 wrote to memory of 2160 3696 950C.tmp 105 PID 2160 wrote to memory of 3140 2160 9579.tmp 106 PID 2160 wrote to memory of 3140 2160 9579.tmp 106 PID 2160 wrote to memory of 3140 2160 9579.tmp 106 PID 3140 wrote to memory of 2016 3140 9616.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-11_1da99ca3d4d2f43363015913cac3789e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-11_1da99ca3d4d2f43363015913cac3789e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"23⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"24⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"25⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"26⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"27⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"28⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"29⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"30⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"31⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"32⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"33⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"34⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"35⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"36⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"37⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"38⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"39⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"40⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"41⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"42⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"43⤵
- Executes dropped EXE
PID:496 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"44⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"45⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"46⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"47⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"48⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"49⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"50⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"51⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"52⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"53⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"54⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"55⤵
- Executes dropped EXE
PID:656 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"56⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"57⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"58⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"59⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"60⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"61⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"62⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"63⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"64⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"65⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"66⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"67⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"68⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"69⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"70⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"71⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"72⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"73⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"74⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"75⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"76⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"77⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"78⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"79⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"80⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"81⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"82⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"83⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"84⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"85⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"86⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"87⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"88⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"89⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"90⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"91⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"92⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"93⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"94⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"95⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"96⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"97⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"98⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"99⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"100⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"101⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"102⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"103⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"104⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"105⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"106⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"107⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"108⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"109⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"110⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"111⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"112⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"113⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"114⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"115⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"116⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"117⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"118⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"119⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"120⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"121⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"122⤵PID:4068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-