Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 06:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe
Resource
win7-20240705-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe
-
Size
530KB
-
MD5
4dc76e309bc6c39378196f120267d5e3
-
SHA1
14edb40a9d3b3e335587b42a1c73a6ffb64ebb88
-
SHA256
aa08d44a3afccdf5c1b84afd3323a71e7ef4f73f3457ba6008673ce30849376a
-
SHA512
7753aa3dec501e218704a1137403acdc4a43929c35c70ba3367bd3392fa835269241311198b0fad5cc5c46d0b642ad639ba1bf2c3a62ec38d630f0db36021e94
-
SSDEEP
12288:AU5rCOTeio4/cGRpIkPI/Xg42GD8m/4T8NZulFVg0M1:AUQOJoELpk/wYQmQT8NclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2404 81D2.tmp 1368 828E.tmp 4524 8368.tmp 5108 83E5.tmp 2188 8443.tmp 1688 84A1.tmp 3960 851E.tmp 3876 856C.tmp 4656 85D9.tmp 4628 8656.tmp 4236 86B4.tmp 3572 8712.tmp 3408 878F.tmp 4320 87ED.tmp 384 884A.tmp 4448 88B8.tmp 4240 8916.tmp 4608 8973.tmp 368 89F0.tmp 2428 8A5E.tmp 5056 8AEA.tmp 2292 8B38.tmp 2328 8B96.tmp 2332 8C13.tmp 2248 8CA0.tmp 4116 8CEE.tmp 3096 8D6B.tmp 4584 8DC9.tmp 4664 8E26.tmp 3152 8E84.tmp 4036 8EF2.tmp 4748 8F7E.tmp 4208 902A.tmp 1292 9088.tmp 3660 90E6.tmp 4848 9143.tmp 1764 9191.tmp 5100 91E0.tmp 4552 922E.tmp 4404 928B.tmp 3712 92DA.tmp 2984 9328.tmp 4968 9376.tmp 4540 93D4.tmp 1980 9431.tmp 2872 948F.tmp 2660 94ED.tmp 1368 953B.tmp 2900 9589.tmp 1496 95D7.tmp 3448 9625.tmp 3640 9673.tmp 2264 96C2.tmp 1516 971F.tmp 4344 977D.tmp 2456 97DB.tmp 4424 9839.tmp 2704 9896.tmp 1336 98F4.tmp 3600 9942.tmp 3316 9990.tmp 2692 99DE.tmp 2976 9A3C.tmp 3572 9A9A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3328 wrote to memory of 2404 3328 2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe 83 PID 3328 wrote to memory of 2404 3328 2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe 83 PID 3328 wrote to memory of 2404 3328 2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe 83 PID 2404 wrote to memory of 1368 2404 81D2.tmp 85 PID 2404 wrote to memory of 1368 2404 81D2.tmp 85 PID 2404 wrote to memory of 1368 2404 81D2.tmp 85 PID 1368 wrote to memory of 4524 1368 828E.tmp 87 PID 1368 wrote to memory of 4524 1368 828E.tmp 87 PID 1368 wrote to memory of 4524 1368 828E.tmp 87 PID 4524 wrote to memory of 5108 4524 8368.tmp 88 PID 4524 wrote to memory of 5108 4524 8368.tmp 88 PID 4524 wrote to memory of 5108 4524 8368.tmp 88 PID 5108 wrote to memory of 2188 5108 83E5.tmp 89 PID 5108 wrote to memory of 2188 5108 83E5.tmp 89 PID 5108 wrote to memory of 2188 5108 83E5.tmp 89 PID 2188 wrote to memory of 1688 2188 8443.tmp 90 PID 2188 wrote to memory of 1688 2188 8443.tmp 90 PID 2188 wrote to memory of 1688 2188 8443.tmp 90 PID 1688 wrote to memory of 3960 1688 84A1.tmp 91 PID 1688 wrote to memory of 3960 1688 84A1.tmp 91 PID 1688 wrote to memory of 3960 1688 84A1.tmp 91 PID 3960 wrote to memory of 3876 3960 851E.tmp 92 PID 3960 wrote to memory of 3876 3960 851E.tmp 92 PID 3960 wrote to memory of 3876 3960 851E.tmp 92 PID 3876 wrote to memory of 4656 3876 856C.tmp 93 PID 3876 wrote to memory of 4656 3876 856C.tmp 93 PID 3876 wrote to memory of 4656 3876 856C.tmp 93 PID 4656 wrote to memory of 4628 4656 85D9.tmp 94 PID 4656 wrote to memory of 4628 4656 85D9.tmp 94 PID 4656 wrote to memory of 4628 4656 85D9.tmp 94 PID 4628 wrote to memory of 4236 4628 8656.tmp 95 PID 4628 wrote to memory of 4236 4628 8656.tmp 95 PID 4628 wrote to memory of 4236 4628 8656.tmp 95 PID 4236 wrote to memory of 3572 4236 86B4.tmp 96 PID 4236 wrote to memory of 3572 4236 86B4.tmp 96 PID 4236 wrote to memory of 3572 4236 86B4.tmp 96 PID 3572 wrote to memory of 3408 3572 8712.tmp 97 PID 3572 wrote to memory of 3408 3572 8712.tmp 97 PID 3572 wrote to memory of 3408 3572 8712.tmp 97 PID 3408 wrote to memory of 4320 3408 878F.tmp 98 PID 3408 wrote to memory of 4320 3408 878F.tmp 98 PID 3408 wrote to memory of 4320 3408 878F.tmp 98 PID 4320 wrote to memory of 384 4320 87ED.tmp 99 PID 4320 wrote to memory of 384 4320 87ED.tmp 99 PID 4320 wrote to memory of 384 4320 87ED.tmp 99 PID 384 wrote to memory of 4448 384 884A.tmp 100 PID 384 wrote to memory of 4448 384 884A.tmp 100 PID 384 wrote to memory of 4448 384 884A.tmp 100 PID 4448 wrote to memory of 4240 4448 88B8.tmp 101 PID 4448 wrote to memory of 4240 4448 88B8.tmp 101 PID 4448 wrote to memory of 4240 4448 88B8.tmp 101 PID 4240 wrote to memory of 4608 4240 8916.tmp 102 PID 4240 wrote to memory of 4608 4240 8916.tmp 102 PID 4240 wrote to memory of 4608 4240 8916.tmp 102 PID 4608 wrote to memory of 368 4608 8973.tmp 103 PID 4608 wrote to memory of 368 4608 8973.tmp 103 PID 4608 wrote to memory of 368 4608 8973.tmp 103 PID 368 wrote to memory of 2428 368 89F0.tmp 104 PID 368 wrote to memory of 2428 368 89F0.tmp 104 PID 368 wrote to memory of 2428 368 89F0.tmp 104 PID 2428 wrote to memory of 5056 2428 8A5E.tmp 105 PID 2428 wrote to memory of 5056 2428 8A5E.tmp 105 PID 2428 wrote to memory of 5056 2428 8A5E.tmp 105 PID 5056 wrote to memory of 2292 5056 8AEA.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\856C.tmp"C:\Users\Admin\AppData\Local\Temp\856C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"23⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"24⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"25⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"26⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"27⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"28⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"29⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"30⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"31⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"32⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"33⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"34⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"35⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"36⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"37⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"38⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"39⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"40⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"41⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"42⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"43⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"44⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"45⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"46⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"47⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"48⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"49⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"50⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"51⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"52⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"53⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"54⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"55⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"56⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"57⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"58⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"59⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"60⤵
- Executes dropped EXE
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"61⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"62⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"63⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"64⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"65⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"66⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"67⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"68⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"69⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"70⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"71⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"72⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"73⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"74⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"75⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"76⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"77⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"78⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"79⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"80⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"81⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"82⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"83⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"84⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"85⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"86⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"87⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"88⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"89⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"90⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"91⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"92⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"93⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"94⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"95⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"96⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"97⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"98⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"99⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"100⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"101⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"102⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"103⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"104⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"105⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"106⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"107⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"108⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"109⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"110⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"111⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"112⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"113⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"114⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"115⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"116⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"117⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"118⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"119⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"120⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"121⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"122⤵PID:2820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-