Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 14:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-20_f445fdc94ffdbf03311c2b8fb1eafb88_mafia.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-20_f445fdc94ffdbf03311c2b8fb1eafb88_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-20_f445fdc94ffdbf03311c2b8fb1eafb88_mafia.exe
-
Size
530KB
-
MD5
f445fdc94ffdbf03311c2b8fb1eafb88
-
SHA1
35ce6600207af9bf767c16e4f1b7c5f3f0481b8c
-
SHA256
4908b71659cb8d2dfe94ce75873d024855ae6910982eba5c25e7765bc77f8c65
-
SHA512
1ea1d0f1894fa3917d729afec2512cf236417dc8216ee85c6280e98b56f882a4a0c4a07930037f9ccc784fd0c659d0b6e1d066f1af5ca7cb96439fd3cfa37c43
-
SSDEEP
12288:AU5rCOTeiobfLnRfpfskndmDUVTlKT/TNZulFVg0M1:AUQOJoPv9VTlKT/TNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 924 88D7.tmp 4996 8944.tmp 3128 89C1.tmp 1536 8A4E.tmp 1664 8ABB.tmp 3956 8B48.tmp 1608 8BE4.tmp 2020 8C32.tmp 1416 8CAF.tmp 2236 8D1D.tmp 4896 8D7B.tmp 4884 8DD8.tmp 60 8E36.tmp 3772 8E94.tmp 2184 8EF2.tmp 1948 8F4F.tmp 3260 8FAD.tmp 4744 901A.tmp 4628 90A7.tmp 4988 9114.tmp 4252 9191.tmp 3304 91EF.tmp 4456 926C.tmp 3124 92DA.tmp 3696 9347.tmp 3576 93B4.tmp 5008 9402.tmp 1708 947F.tmp 4416 94ED.tmp 3800 956A.tmp 4208 95B8.tmp 1208 9645.tmp 4564 96C2.tmp 3724 9710.tmp 4228 976D.tmp 5044 97BC.tmp 3708 980A.tmp 4804 9867.tmp 4452 98B6.tmp 1284 9904.tmp 3764 9961.tmp 1304 99B0.tmp 4372 99FE.tmp 3980 9A4C.tmp 4524 9A9A.tmp 2392 9AE8.tmp 2988 9B46.tmp 3460 9B94.tmp 1248 9BF2.tmp 1604 9C40.tmp 1424 9C9E.tmp 4768 9CFB.tmp 4888 9D49.tmp 4244 9D98.tmp 4648 9DE6.tmp 376 9E34.tmp 3164 9E82.tmp 3180 9ED0.tmp 4808 9F2E.tmp 1060 9F7C.tmp 1276 9FCA.tmp 1636 A018.tmp 940 A066.tmp 3128 A0B4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1676 wrote to memory of 924 1676 2024-06-20_f445fdc94ffdbf03311c2b8fb1eafb88_mafia.exe 82 PID 1676 wrote to memory of 924 1676 2024-06-20_f445fdc94ffdbf03311c2b8fb1eafb88_mafia.exe 82 PID 1676 wrote to memory of 924 1676 2024-06-20_f445fdc94ffdbf03311c2b8fb1eafb88_mafia.exe 82 PID 924 wrote to memory of 4996 924 88D7.tmp 83 PID 924 wrote to memory of 4996 924 88D7.tmp 83 PID 924 wrote to memory of 4996 924 88D7.tmp 83 PID 4996 wrote to memory of 3128 4996 8944.tmp 86 PID 4996 wrote to memory of 3128 4996 8944.tmp 86 PID 4996 wrote to memory of 3128 4996 8944.tmp 86 PID 3128 wrote to memory of 1536 3128 89C1.tmp 88 PID 3128 wrote to memory of 1536 3128 89C1.tmp 88 PID 3128 wrote to memory of 1536 3128 89C1.tmp 88 PID 1536 wrote to memory of 1664 1536 8A4E.tmp 89 PID 1536 wrote to memory of 1664 1536 8A4E.tmp 89 PID 1536 wrote to memory of 1664 1536 8A4E.tmp 89 PID 1664 wrote to memory of 3956 1664 8ABB.tmp 90 PID 1664 wrote to memory of 3956 1664 8ABB.tmp 90 PID 1664 wrote to memory of 3956 1664 8ABB.tmp 90 PID 3956 wrote to memory of 1608 3956 8B48.tmp 91 PID 3956 wrote to memory of 1608 3956 8B48.tmp 91 PID 3956 wrote to memory of 1608 3956 8B48.tmp 91 PID 1608 wrote to memory of 2020 1608 8BE4.tmp 92 PID 1608 wrote to memory of 2020 1608 8BE4.tmp 92 PID 1608 wrote to memory of 2020 1608 8BE4.tmp 92 PID 2020 wrote to memory of 1416 2020 8C32.tmp 93 PID 2020 wrote to memory of 1416 2020 8C32.tmp 93 PID 2020 wrote to memory of 1416 2020 8C32.tmp 93 PID 1416 wrote to memory of 2236 1416 8CAF.tmp 94 PID 1416 wrote to memory of 2236 1416 8CAF.tmp 94 PID 1416 wrote to memory of 2236 1416 8CAF.tmp 94 PID 2236 wrote to memory of 4896 2236 8D1D.tmp 95 PID 2236 wrote to memory of 4896 2236 8D1D.tmp 95 PID 2236 wrote to memory of 4896 2236 8D1D.tmp 95 PID 4896 wrote to memory of 4884 4896 8D7B.tmp 96 PID 4896 wrote to memory of 4884 4896 8D7B.tmp 96 PID 4896 wrote to memory of 4884 4896 8D7B.tmp 96 PID 4884 wrote to memory of 60 4884 8DD8.tmp 97 PID 4884 wrote to memory of 60 4884 8DD8.tmp 97 PID 4884 wrote to memory of 60 4884 8DD8.tmp 97 PID 60 wrote to memory of 3772 60 8E36.tmp 98 PID 60 wrote to memory of 3772 60 8E36.tmp 98 PID 60 wrote to memory of 3772 60 8E36.tmp 98 PID 3772 wrote to memory of 2184 3772 8E94.tmp 99 PID 3772 wrote to memory of 2184 3772 8E94.tmp 99 PID 3772 wrote to memory of 2184 3772 8E94.tmp 99 PID 2184 wrote to memory of 1948 2184 8EF2.tmp 100 PID 2184 wrote to memory of 1948 2184 8EF2.tmp 100 PID 2184 wrote to memory of 1948 2184 8EF2.tmp 100 PID 1948 wrote to memory of 3260 1948 8F4F.tmp 101 PID 1948 wrote to memory of 3260 1948 8F4F.tmp 101 PID 1948 wrote to memory of 3260 1948 8F4F.tmp 101 PID 3260 wrote to memory of 4744 3260 8FAD.tmp 102 PID 3260 wrote to memory of 4744 3260 8FAD.tmp 102 PID 3260 wrote to memory of 4744 3260 8FAD.tmp 102 PID 4744 wrote to memory of 4628 4744 901A.tmp 103 PID 4744 wrote to memory of 4628 4744 901A.tmp 103 PID 4744 wrote to memory of 4628 4744 901A.tmp 103 PID 4628 wrote to memory of 4988 4628 90A7.tmp 104 PID 4628 wrote to memory of 4988 4628 90A7.tmp 104 PID 4628 wrote to memory of 4988 4628 90A7.tmp 104 PID 4988 wrote to memory of 4252 4988 9114.tmp 105 PID 4988 wrote to memory of 4252 4988 9114.tmp 105 PID 4988 wrote to memory of 4252 4988 9114.tmp 105 PID 4252 wrote to memory of 3304 4252 9191.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-20_f445fdc94ffdbf03311c2b8fb1eafb88_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-20_f445fdc94ffdbf03311c2b8fb1eafb88_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"23⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"24⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"25⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"26⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"27⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"28⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"29⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"30⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"31⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"32⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"33⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"34⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"35⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"36⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"37⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"38⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"39⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"40⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"41⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"42⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"43⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"44⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"45⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"46⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"47⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"48⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"49⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"50⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"51⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"52⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"53⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"54⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"55⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"56⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"57⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"58⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"59⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"60⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"61⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"62⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"63⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"64⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"65⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"66⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"67⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"68⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"69⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"70⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"71⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"72⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"73⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"74⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"75⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"76⤵PID:184
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"77⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"78⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"79⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"80⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"81⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"82⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"83⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"84⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"85⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"86⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"87⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"88⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"89⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"90⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"91⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"92⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"93⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"94⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"95⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"96⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"97⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"98⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"99⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"100⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"101⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"102⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"103⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"104⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"105⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"106⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"107⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"108⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"109⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"110⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"111⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"112⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"113⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"114⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"115⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"116⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"117⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"118⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"119⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"120⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"121⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"122⤵PID:1400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-