Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 22:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-05_9eed8b095eef79185602e7bfd5fa4ee7_mafia.exe
Resource
win7-20240704-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-05_9eed8b095eef79185602e7bfd5fa4ee7_mafia.exe
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
2024-07-05_9eed8b095eef79185602e7bfd5fa4ee7_mafia.exe
-
Size
486KB
-
MD5
9eed8b095eef79185602e7bfd5fa4ee7
-
SHA1
e8c5809a4f2560e356f9d2fc2f2178a0947b2985
-
SHA256
f3597161d3811387dd6bb14244d32094a5aa5566b1e9f08aadebe75ee2059064
-
SHA512
9fdaeea3dc594ace6a10e732f2234e9a011d605a35819510f4e6cb82f54df63de739429f1fc2472dcbdf493233791f6737121f68715f21561341eea70f917d22
-
SSDEEP
12288:UU5rCOTeiD9HcNyJ6xuqVy0jPvXAlSBSiZt+nNZ:UUQOJD9HYyJ6xvVRjQlSU+EnN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1208 AB9.tmp 1032 B36.tmp 4252 B94.tmp 4984 C30.tmp 2816 CAD.tmp 4908 D3A.tmp 3600 DB7.tmp 2396 E34.tmp 1868 EB1.tmp 1524 F1E.tmp 4248 FBA.tmp 3964 1047.tmp 3868 10A5.tmp 2540 1151.tmp 1740 11DD.tmp 2136 123B.tmp 372 12B8.tmp 4408 1325.tmp 2224 13C2.tmp 2472 144E.tmp 1588 14BC.tmp 116 1519.tmp 1384 1577.tmp 1768 15F4.tmp 2172 1671.tmp 4180 16FE.tmp 5052 178A.tmp 1752 1817.tmp 1656 1884.tmp 1548 18E2.tmp 2832 195F.tmp 4632 19FB.tmp 3680 1A69.tmp 408 1AC6.tmp 1096 1B24.tmp 3392 1B82.tmp 4900 1BD0.tmp 5092 1C1E.tmp 624 1C8C.tmp 2736 1CDA.tmp 2352 1D28.tmp 1036 1D76.tmp 2612 1DD4.tmp 756 1E31.tmp 1632 1E8F.tmp 4384 1EED.tmp 4652 1F4B.tmp 2180 1FB8.tmp 968 2006.tmp 1004 2074.tmp 4308 20E1.tmp 3620 214E.tmp 2864 21BC.tmp 3548 2219.tmp 4988 2277.tmp 4524 22C5.tmp 3956 2313.tmp 1032 2381.tmp 4940 23EE.tmp 3416 245C.tmp 2424 24AA.tmp 5000 2507.tmp 4328 2575.tmp 3848 25D3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1116 wrote to memory of 1208 1116 2024-07-05_9eed8b095eef79185602e7bfd5fa4ee7_mafia.exe 84 PID 1116 wrote to memory of 1208 1116 2024-07-05_9eed8b095eef79185602e7bfd5fa4ee7_mafia.exe 84 PID 1116 wrote to memory of 1208 1116 2024-07-05_9eed8b095eef79185602e7bfd5fa4ee7_mafia.exe 84 PID 1208 wrote to memory of 1032 1208 AB9.tmp 85 PID 1208 wrote to memory of 1032 1208 AB9.tmp 85 PID 1208 wrote to memory of 1032 1208 AB9.tmp 85 PID 1032 wrote to memory of 4252 1032 B36.tmp 87 PID 1032 wrote to memory of 4252 1032 B36.tmp 87 PID 1032 wrote to memory of 4252 1032 B36.tmp 87 PID 4252 wrote to memory of 4984 4252 B94.tmp 88 PID 4252 wrote to memory of 4984 4252 B94.tmp 88 PID 4252 wrote to memory of 4984 4252 B94.tmp 88 PID 4984 wrote to memory of 2816 4984 C30.tmp 89 PID 4984 wrote to memory of 2816 4984 C30.tmp 89 PID 4984 wrote to memory of 2816 4984 C30.tmp 89 PID 2816 wrote to memory of 4908 2816 CAD.tmp 90 PID 2816 wrote to memory of 4908 2816 CAD.tmp 90 PID 2816 wrote to memory of 4908 2816 CAD.tmp 90 PID 4908 wrote to memory of 3600 4908 D3A.tmp 91 PID 4908 wrote to memory of 3600 4908 D3A.tmp 91 PID 4908 wrote to memory of 3600 4908 D3A.tmp 91 PID 3600 wrote to memory of 2396 3600 DB7.tmp 92 PID 3600 wrote to memory of 2396 3600 DB7.tmp 92 PID 3600 wrote to memory of 2396 3600 DB7.tmp 92 PID 2396 wrote to memory of 1868 2396 E34.tmp 93 PID 2396 wrote to memory of 1868 2396 E34.tmp 93 PID 2396 wrote to memory of 1868 2396 E34.tmp 93 PID 1868 wrote to memory of 1524 1868 EB1.tmp 94 PID 1868 wrote to memory of 1524 1868 EB1.tmp 94 PID 1868 wrote to memory of 1524 1868 EB1.tmp 94 PID 1524 wrote to memory of 4248 1524 F1E.tmp 95 PID 1524 wrote to memory of 4248 1524 F1E.tmp 95 PID 1524 wrote to memory of 4248 1524 F1E.tmp 95 PID 4248 wrote to memory of 3964 4248 FBA.tmp 96 PID 4248 wrote to memory of 3964 4248 FBA.tmp 96 PID 4248 wrote to memory of 3964 4248 FBA.tmp 96 PID 3964 wrote to memory of 3868 3964 1047.tmp 97 PID 3964 wrote to memory of 3868 3964 1047.tmp 97 PID 3964 wrote to memory of 3868 3964 1047.tmp 97 PID 3868 wrote to memory of 2540 3868 10A5.tmp 98 PID 3868 wrote to memory of 2540 3868 10A5.tmp 98 PID 3868 wrote to memory of 2540 3868 10A5.tmp 98 PID 2540 wrote to memory of 1740 2540 1151.tmp 99 PID 2540 wrote to memory of 1740 2540 1151.tmp 99 PID 2540 wrote to memory of 1740 2540 1151.tmp 99 PID 1740 wrote to memory of 2136 1740 11DD.tmp 100 PID 1740 wrote to memory of 2136 1740 11DD.tmp 100 PID 1740 wrote to memory of 2136 1740 11DD.tmp 100 PID 2136 wrote to memory of 372 2136 123B.tmp 101 PID 2136 wrote to memory of 372 2136 123B.tmp 101 PID 2136 wrote to memory of 372 2136 123B.tmp 101 PID 372 wrote to memory of 4408 372 12B8.tmp 102 PID 372 wrote to memory of 4408 372 12B8.tmp 102 PID 372 wrote to memory of 4408 372 12B8.tmp 102 PID 4408 wrote to memory of 2224 4408 1325.tmp 103 PID 4408 wrote to memory of 2224 4408 1325.tmp 103 PID 4408 wrote to memory of 2224 4408 1325.tmp 103 PID 2224 wrote to memory of 2472 2224 13C2.tmp 104 PID 2224 wrote to memory of 2472 2224 13C2.tmp 104 PID 2224 wrote to memory of 2472 2224 13C2.tmp 104 PID 2472 wrote to memory of 1588 2472 144E.tmp 105 PID 2472 wrote to memory of 1588 2472 144E.tmp 105 PID 2472 wrote to memory of 1588 2472 144E.tmp 105 PID 1588 wrote to memory of 116 1588 14BC.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-05_9eed8b095eef79185602e7bfd5fa4ee7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-05_9eed8b095eef79185602e7bfd5fa4ee7_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\B94.tmp"C:\Users\Admin\AppData\Local\Temp\B94.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\C30.tmp"C:\Users\Admin\AppData\Local\Temp\C30.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\CAD.tmp"C:\Users\Admin\AppData\Local\Temp\CAD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\10A5.tmp"C:\Users\Admin\AppData\Local\Temp\10A5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\11DD.tmp"C:\Users\Admin\AppData\Local\Temp\11DD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\12B8.tmp"C:\Users\Admin\AppData\Local\Temp\12B8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\1325.tmp"C:\Users\Admin\AppData\Local\Temp\1325.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\1519.tmp"C:\Users\Admin\AppData\Local\Temp\1519.tmp"23⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"24⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"25⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\1671.tmp"C:\Users\Admin\AppData\Local\Temp\1671.tmp"26⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\16FE.tmp"C:\Users\Admin\AppData\Local\Temp\16FE.tmp"27⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\178A.tmp"C:\Users\Admin\AppData\Local\Temp\178A.tmp"28⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"29⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"30⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\18E2.tmp"C:\Users\Admin\AppData\Local\Temp\18E2.tmp"31⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\195F.tmp"C:\Users\Admin\AppData\Local\Temp\195F.tmp"32⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\19FB.tmp"C:\Users\Admin\AppData\Local\Temp\19FB.tmp"33⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"34⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"35⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"36⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\1B82.tmp"C:\Users\Admin\AppData\Local\Temp\1B82.tmp"37⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"38⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"39⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"40⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"41⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\1D28.tmp"C:\Users\Admin\AppData\Local\Temp\1D28.tmp"42⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\1D76.tmp"C:\Users\Admin\AppData\Local\Temp\1D76.tmp"43⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"44⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\1E31.tmp"C:\Users\Admin\AppData\Local\Temp\1E31.tmp"45⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"46⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\1EED.tmp"C:\Users\Admin\AppData\Local\Temp\1EED.tmp"47⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"48⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"49⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\2006.tmp"C:\Users\Admin\AppData\Local\Temp\2006.tmp"50⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\2074.tmp"C:\Users\Admin\AppData\Local\Temp\2074.tmp"51⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\20E1.tmp"C:\Users\Admin\AppData\Local\Temp\20E1.tmp"52⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\214E.tmp"C:\Users\Admin\AppData\Local\Temp\214E.tmp"53⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\21BC.tmp"C:\Users\Admin\AppData\Local\Temp\21BC.tmp"54⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\2219.tmp"C:\Users\Admin\AppData\Local\Temp\2219.tmp"55⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"56⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"57⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\2313.tmp"C:\Users\Admin\AppData\Local\Temp\2313.tmp"58⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\2381.tmp"C:\Users\Admin\AppData\Local\Temp\2381.tmp"59⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"60⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\245C.tmp"C:\Users\Admin\AppData\Local\Temp\245C.tmp"61⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\24AA.tmp"C:\Users\Admin\AppData\Local\Temp\24AA.tmp"62⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\2507.tmp"C:\Users\Admin\AppData\Local\Temp\2507.tmp"63⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\2575.tmp"C:\Users\Admin\AppData\Local\Temp\2575.tmp"64⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"65⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\2640.tmp"C:\Users\Admin\AppData\Local\Temp\2640.tmp"66⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"67⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\26FB.tmp"C:\Users\Admin\AppData\Local\Temp\26FB.tmp"68⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"69⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\27A7.tmp"C:\Users\Admin\AppData\Local\Temp\27A7.tmp"70⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\2805.tmp"C:\Users\Admin\AppData\Local\Temp\2805.tmp"71⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"72⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\28A1.tmp"C:\Users\Admin\AppData\Local\Temp\28A1.tmp"73⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"74⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\294D.tmp"C:\Users\Admin\AppData\Local\Temp\294D.tmp"75⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\29AB.tmp"C:\Users\Admin\AppData\Local\Temp\29AB.tmp"76⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\2A09.tmp"C:\Users\Admin\AppData\Local\Temp\2A09.tmp"77⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"78⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"79⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"80⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\2B80.tmp"C:\Users\Admin\AppData\Local\Temp\2B80.tmp"81⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"82⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"83⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"84⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"85⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"86⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\2D74.tmp"C:\Users\Admin\AppData\Local\Temp\2D74.tmp"87⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\2DD1.tmp"C:\Users\Admin\AppData\Local\Temp\2DD1.tmp"88⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"89⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"90⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"91⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\2F68.tmp"C:\Users\Admin\AppData\Local\Temp\2F68.tmp"92⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"93⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\3042.tmp"C:\Users\Admin\AppData\Local\Temp\3042.tmp"94⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\30A0.tmp"C:\Users\Admin\AppData\Local\Temp\30A0.tmp"95⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"96⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\314C.tmp"C:\Users\Admin\AppData\Local\Temp\314C.tmp"97⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"98⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\3217.tmp"C:\Users\Admin\AppData\Local\Temp\3217.tmp"99⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\3275.tmp"C:\Users\Admin\AppData\Local\Temp\3275.tmp"100⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"101⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\3330.tmp"C:\Users\Admin\AppData\Local\Temp\3330.tmp"102⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"103⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"104⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"105⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"106⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"107⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"108⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\35B1.tmp"C:\Users\Admin\AppData\Local\Temp\35B1.tmp"109⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"110⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"111⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\36DA.tmp"C:\Users\Admin\AppData\Local\Temp\36DA.tmp"112⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"113⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\3795.tmp"C:\Users\Admin\AppData\Local\Temp\3795.tmp"114⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"115⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\3832.tmp"C:\Users\Admin\AppData\Local\Temp\3832.tmp"116⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\389F.tmp"C:\Users\Admin\AppData\Local\Temp\389F.tmp"117⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"118⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"119⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\39C8.tmp"C:\Users\Admin\AppData\Local\Temp\39C8.tmp"120⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\3A16.tmp"C:\Users\Admin\AppData\Local\Temp\3A16.tmp"121⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\3A83.tmp"C:\Users\Admin\AppData\Local\Temp\3A83.tmp"122⤵PID:4344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-