Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 13:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-05_5a99153b855e690a7dcafe42510a3a14_mafia.exe
Resource
win7-20240704-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-05_5a99153b855e690a7dcafe42510a3a14_mafia.exe
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
2024-07-05_5a99153b855e690a7dcafe42510a3a14_mafia.exe
-
Size
488KB
-
MD5
5a99153b855e690a7dcafe42510a3a14
-
SHA1
c621a4351cbcc36ab492bfd5f7e01128130eb7a4
-
SHA256
7709f16bf2d7484257ac220db7790c949be0297dea6dbaaf95e67bc5f10d157e
-
SHA512
85a89b3857b6cdb85ca086a32b2d8be7fc020525fd156ba0c1d6a76d979e18a7a960525a08d8064e6873fd65be233adcaf1ef1378db3da5a07a1339c601fe08f
-
SSDEEP
12288:/U5rCOTeiDrArG512VWY3nha1xIrdsy/8+NZ:/UQOJDrArG5cWanYDK2R+N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1184 ABB1.tmp 2804 AC0F.tmp 4404 AC6C.tmp 2832 ACBB.tmp 5012 AD09.tmp 3936 AD57.tmp 2480 ADA5.tmp 2520 ADF3.tmp 948 AE41.tmp 4772 AE8F.tmp 4892 AEDD.tmp 216 AF3B.tmp 3984 AF89.tmp 792 AFD7.tmp 1104 B035.tmp 2672 B0A3.tmp 60 B0F1.tmp 2696 B13F.tmp 1468 B18D.tmp 3800 B1EB.tmp 3508 B239.tmp 3920 B287.tmp 4676 B2D5.tmp 704 B323.tmp 2916 B3A0.tmp 932 B3EE.tmp 2464 B43C.tmp 4500 B48B.tmp 3908 B4E8.tmp 4916 B536.tmp 4068 B575.tmp 4084 B5C3.tmp 4036 B621.tmp 4060 B67F.tmp 4092 B6CD.tmp 1432 B71B.tmp 1584 B769.tmp 3548 B7B7.tmp 2356 B805.tmp 2964 B853.tmp 2116 B8A1.tmp 4776 B8F0.tmp 2736 B93E.tmp 32 B97C.tmp 3468 B9CA.tmp 1892 BA18.tmp 4560 BA67.tmp 2876 BAA5.tmp 4488 BAE4.tmp 2864 BB32.tmp 2340 BB70.tmp 5112 BBAF.tmp 2412 BBED.tmp 2772 BC3B.tmp 4504 BC7A.tmp 1800 BCC8.tmp 4664 BD06.tmp 4864 BD45.tmp 400 BD83.tmp 1188 BDD2.tmp 2716 BE10.tmp 3224 BE4F.tmp 3440 BE9D.tmp 4828 BEDB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1716 wrote to memory of 1184 1716 2024-07-05_5a99153b855e690a7dcafe42510a3a14_mafia.exe 84 PID 1716 wrote to memory of 1184 1716 2024-07-05_5a99153b855e690a7dcafe42510a3a14_mafia.exe 84 PID 1716 wrote to memory of 1184 1716 2024-07-05_5a99153b855e690a7dcafe42510a3a14_mafia.exe 84 PID 1184 wrote to memory of 2804 1184 ABB1.tmp 85 PID 1184 wrote to memory of 2804 1184 ABB1.tmp 85 PID 1184 wrote to memory of 2804 1184 ABB1.tmp 85 PID 2804 wrote to memory of 4404 2804 AC0F.tmp 86 PID 2804 wrote to memory of 4404 2804 AC0F.tmp 86 PID 2804 wrote to memory of 4404 2804 AC0F.tmp 86 PID 4404 wrote to memory of 2832 4404 AC6C.tmp 87 PID 4404 wrote to memory of 2832 4404 AC6C.tmp 87 PID 4404 wrote to memory of 2832 4404 AC6C.tmp 87 PID 2832 wrote to memory of 5012 2832 ACBB.tmp 88 PID 2832 wrote to memory of 5012 2832 ACBB.tmp 88 PID 2832 wrote to memory of 5012 2832 ACBB.tmp 88 PID 5012 wrote to memory of 3936 5012 AD09.tmp 89 PID 5012 wrote to memory of 3936 5012 AD09.tmp 89 PID 5012 wrote to memory of 3936 5012 AD09.tmp 89 PID 3936 wrote to memory of 2480 3936 AD57.tmp 90 PID 3936 wrote to memory of 2480 3936 AD57.tmp 90 PID 3936 wrote to memory of 2480 3936 AD57.tmp 90 PID 2480 wrote to memory of 2520 2480 ADA5.tmp 91 PID 2480 wrote to memory of 2520 2480 ADA5.tmp 91 PID 2480 wrote to memory of 2520 2480 ADA5.tmp 91 PID 2520 wrote to memory of 948 2520 ADF3.tmp 92 PID 2520 wrote to memory of 948 2520 ADF3.tmp 92 PID 2520 wrote to memory of 948 2520 ADF3.tmp 92 PID 948 wrote to memory of 4772 948 AE41.tmp 93 PID 948 wrote to memory of 4772 948 AE41.tmp 93 PID 948 wrote to memory of 4772 948 AE41.tmp 93 PID 4772 wrote to memory of 4892 4772 AE8F.tmp 94 PID 4772 wrote to memory of 4892 4772 AE8F.tmp 94 PID 4772 wrote to memory of 4892 4772 AE8F.tmp 94 PID 4892 wrote to memory of 216 4892 AEDD.tmp 95 PID 4892 wrote to memory of 216 4892 AEDD.tmp 95 PID 4892 wrote to memory of 216 4892 AEDD.tmp 95 PID 216 wrote to memory of 3984 216 AF3B.tmp 162 PID 216 wrote to memory of 3984 216 AF3B.tmp 162 PID 216 wrote to memory of 3984 216 AF3B.tmp 162 PID 3984 wrote to memory of 792 3984 AF89.tmp 97 PID 3984 wrote to memory of 792 3984 AF89.tmp 97 PID 3984 wrote to memory of 792 3984 AF89.tmp 97 PID 792 wrote to memory of 1104 792 AFD7.tmp 98 PID 792 wrote to memory of 1104 792 AFD7.tmp 98 PID 792 wrote to memory of 1104 792 AFD7.tmp 98 PID 1104 wrote to memory of 2672 1104 B035.tmp 99 PID 1104 wrote to memory of 2672 1104 B035.tmp 99 PID 1104 wrote to memory of 2672 1104 B035.tmp 99 PID 2672 wrote to memory of 60 2672 B0A3.tmp 100 PID 2672 wrote to memory of 60 2672 B0A3.tmp 100 PID 2672 wrote to memory of 60 2672 B0A3.tmp 100 PID 60 wrote to memory of 2696 60 B0F1.tmp 101 PID 60 wrote to memory of 2696 60 B0F1.tmp 101 PID 60 wrote to memory of 2696 60 B0F1.tmp 101 PID 2696 wrote to memory of 1468 2696 B13F.tmp 102 PID 2696 wrote to memory of 1468 2696 B13F.tmp 102 PID 2696 wrote to memory of 1468 2696 B13F.tmp 102 PID 1468 wrote to memory of 3800 1468 B18D.tmp 103 PID 1468 wrote to memory of 3800 1468 B18D.tmp 103 PID 1468 wrote to memory of 3800 1468 B18D.tmp 103 PID 3800 wrote to memory of 3508 3800 B1EB.tmp 104 PID 3800 wrote to memory of 3508 3800 B1EB.tmp 104 PID 3800 wrote to memory of 3508 3800 B1EB.tmp 104 PID 3508 wrote to memory of 3920 3508 B239.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-05_5a99153b855e690a7dcafe42510a3a14_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-05_5a99153b855e690a7dcafe42510a3a14_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"23⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"24⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"25⤵
- Executes dropped EXE
PID:704 -
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"26⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"27⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"28⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"29⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"30⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"31⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"32⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"33⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"34⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"35⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"36⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"37⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"38⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"39⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"40⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"41⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"42⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"43⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"44⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"45⤵
- Executes dropped EXE
PID:32 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"46⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"47⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"48⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"49⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"50⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"51⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"52⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"53⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"54⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"55⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"56⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"57⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"58⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"59⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"60⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"61⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"62⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"63⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"64⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"65⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"66⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"67⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"68⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"69⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"70⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"71⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"72⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"73⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"74⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"75⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"76⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"77⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"78⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"79⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"80⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"81⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"82⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"83⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"84⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"85⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"86⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"87⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"88⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"89⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"90⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"91⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"92⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"93⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"94⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"95⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"96⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"97⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"98⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"99⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"100⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"101⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"102⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"103⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"104⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"105⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"106⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\CD52.tmp"C:\Users\Admin\AppData\Local\Temp\CD52.tmp"107⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"108⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"109⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"110⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"111⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"112⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"113⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"114⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"115⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"116⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"117⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\D188.tmp"C:\Users\Admin\AppData\Local\Temp\D188.tmp"118⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"119⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"120⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\D282.tmp"C:\Users\Admin\AppData\Local\Temp\D282.tmp"121⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"122⤵PID:1248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-