Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 06:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe
-
Size
520KB
-
MD5
96336649e1e9ee2ac110f54f0e7cc75a
-
SHA1
bdd9403b7395847ca69f64937e05d66331e9740e
-
SHA256
dede675ac7947eb0acf331404f5c5fcfc20cb61340378a57f1aae66433c28851
-
SHA512
a5673822d91954fc5263f95d9ca041ff771832ec8737c464c82855bb270875b9a6c75893fba26a6ed05cb80c7211f260b3c10b0f0d54305b66bf65fe5588dedd
-
SSDEEP
12288:gj8fuxR21t5i8fjMpiM3HcgIcKcAPYK/iSfDXelJueaNZ:gj8fuK1GYjMpiMM3PYK/1uJueaN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3828 7B5A.tmp 3452 7BE7.tmp 5056 7C83.tmp 4020 7CE1.tmp 884 7D3E.tmp 320 7D9C.tmp 3924 7E09.tmp 5100 7E86.tmp 3232 7EE4.tmp 2624 7F71.tmp 3952 7FDE.tmp 3504 802C.tmp 3656 807A.tmp 3080 80D8.tmp 1992 8136.tmp 5028 81A3.tmp 3012 8220.tmp 3556 829D.tmp 5092 82EB.tmp 4300 833A.tmp 2964 83B7.tmp 4756 8434.tmp 3512 84A1.tmp 4860 851E.tmp 1756 859B.tmp 1484 8618.tmp 2824 8666.tmp 4748 86C4.tmp 1288 8712.tmp 1264 8760.tmp 4872 87CD.tmp 2852 884A.tmp 1948 88C7.tmp 1132 8935.tmp 3404 8983.tmp 856 89D1.tmp 1268 8A2F.tmp 3992 8A7D.tmp 2104 8ADB.tmp 3568 8B38.tmp 3476 8B87.tmp 4604 8BE4.tmp 4004 8C32.tmp 4380 8C81.tmp 2352 8CCF.tmp 4240 8D1D.tmp 4708 8D7B.tmp 4500 8DC9.tmp 4436 8E36.tmp 4588 8E94.tmp 4740 8EF2.tmp 3560 8F40.tmp 228 8F9D.tmp 1800 8FEC.tmp 3000 9049.tmp 5088 90A7.tmp 1752 9105.tmp 5056 9163.tmp 2000 91C0.tmp 316 920E.tmp 1224 925D.tmp 1672 92BA.tmp 4760 9318.tmp 4956 9376.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2616 wrote to memory of 3828 2616 2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe 83 PID 2616 wrote to memory of 3828 2616 2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe 83 PID 2616 wrote to memory of 3828 2616 2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe 83 PID 3828 wrote to memory of 3452 3828 7B5A.tmp 84 PID 3828 wrote to memory of 3452 3828 7B5A.tmp 84 PID 3828 wrote to memory of 3452 3828 7B5A.tmp 84 PID 3452 wrote to memory of 5056 3452 7BE7.tmp 86 PID 3452 wrote to memory of 5056 3452 7BE7.tmp 86 PID 3452 wrote to memory of 5056 3452 7BE7.tmp 86 PID 5056 wrote to memory of 4020 5056 7C83.tmp 87 PID 5056 wrote to memory of 4020 5056 7C83.tmp 87 PID 5056 wrote to memory of 4020 5056 7C83.tmp 87 PID 4020 wrote to memory of 884 4020 7CE1.tmp 88 PID 4020 wrote to memory of 884 4020 7CE1.tmp 88 PID 4020 wrote to memory of 884 4020 7CE1.tmp 88 PID 884 wrote to memory of 320 884 7D3E.tmp 89 PID 884 wrote to memory of 320 884 7D3E.tmp 89 PID 884 wrote to memory of 320 884 7D3E.tmp 89 PID 320 wrote to memory of 3924 320 7D9C.tmp 90 PID 320 wrote to memory of 3924 320 7D9C.tmp 90 PID 320 wrote to memory of 3924 320 7D9C.tmp 90 PID 3924 wrote to memory of 5100 3924 7E09.tmp 91 PID 3924 wrote to memory of 5100 3924 7E09.tmp 91 PID 3924 wrote to memory of 5100 3924 7E09.tmp 91 PID 5100 wrote to memory of 3232 5100 7E86.tmp 92 PID 5100 wrote to memory of 3232 5100 7E86.tmp 92 PID 5100 wrote to memory of 3232 5100 7E86.tmp 92 PID 3232 wrote to memory of 2624 3232 7EE4.tmp 93 PID 3232 wrote to memory of 2624 3232 7EE4.tmp 93 PID 3232 wrote to memory of 2624 3232 7EE4.tmp 93 PID 2624 wrote to memory of 3952 2624 7F71.tmp 94 PID 2624 wrote to memory of 3952 2624 7F71.tmp 94 PID 2624 wrote to memory of 3952 2624 7F71.tmp 94 PID 3952 wrote to memory of 3504 3952 7FDE.tmp 95 PID 3952 wrote to memory of 3504 3952 7FDE.tmp 95 PID 3952 wrote to memory of 3504 3952 7FDE.tmp 95 PID 3504 wrote to memory of 3656 3504 802C.tmp 96 PID 3504 wrote to memory of 3656 3504 802C.tmp 96 PID 3504 wrote to memory of 3656 3504 802C.tmp 96 PID 3656 wrote to memory of 3080 3656 807A.tmp 97 PID 3656 wrote to memory of 3080 3656 807A.tmp 97 PID 3656 wrote to memory of 3080 3656 807A.tmp 97 PID 3080 wrote to memory of 1992 3080 80D8.tmp 98 PID 3080 wrote to memory of 1992 3080 80D8.tmp 98 PID 3080 wrote to memory of 1992 3080 80D8.tmp 98 PID 1992 wrote to memory of 5028 1992 8136.tmp 99 PID 1992 wrote to memory of 5028 1992 8136.tmp 99 PID 1992 wrote to memory of 5028 1992 8136.tmp 99 PID 5028 wrote to memory of 3012 5028 81A3.tmp 100 PID 5028 wrote to memory of 3012 5028 81A3.tmp 100 PID 5028 wrote to memory of 3012 5028 81A3.tmp 100 PID 3012 wrote to memory of 3556 3012 8220.tmp 101 PID 3012 wrote to memory of 3556 3012 8220.tmp 101 PID 3012 wrote to memory of 3556 3012 8220.tmp 101 PID 3556 wrote to memory of 5092 3556 829D.tmp 102 PID 3556 wrote to memory of 5092 3556 829D.tmp 102 PID 3556 wrote to memory of 5092 3556 829D.tmp 102 PID 5092 wrote to memory of 4300 5092 82EB.tmp 103 PID 5092 wrote to memory of 4300 5092 82EB.tmp 103 PID 5092 wrote to memory of 4300 5092 82EB.tmp 103 PID 4300 wrote to memory of 2964 4300 833A.tmp 104 PID 4300 wrote to memory of 2964 4300 833A.tmp 104 PID 4300 wrote to memory of 2964 4300 833A.tmp 104 PID 2964 wrote to memory of 4756 2964 83B7.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"23⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"24⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"25⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"26⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"27⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"28⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"29⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"30⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"31⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"32⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"33⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"34⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"35⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"36⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"37⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"38⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"39⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"40⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"41⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"42⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"43⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"44⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"45⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"46⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"47⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"48⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"49⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"50⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"51⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"52⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"53⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"54⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"55⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"56⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"57⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"58⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"59⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"60⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"61⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"62⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"63⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"64⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"65⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"66⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"67⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"68⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"69⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"70⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"71⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"72⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"73⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"74⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"75⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"76⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"77⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"78⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"79⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"80⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"81⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"82⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"83⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"84⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"85⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"86⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"87⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"88⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"89⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"90⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"91⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"92⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"93⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"94⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"95⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"96⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"97⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"98⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"99⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"100⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"101⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"102⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"103⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"104⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"105⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"106⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"107⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"108⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"109⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"110⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"111⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"112⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"113⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"114⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"115⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"116⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"117⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"118⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"119⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"120⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"121⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"122⤵PID:1552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-