Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08-07-2024 13:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe
-
Size
486KB
-
MD5
9f2369455073c733c890fdbb588f76e4
-
SHA1
c8a5f138aaf6b907cd6afdc896c8be13045b2839
-
SHA256
c388b65cd042f9e81f7b64d8701ea3171f7180d574a19346b8fde62bc32bb5ae
-
SHA512
b5acda868413ba08b112926d6f0eb1379a5a0fc1b2b54007d986fdcd75ddf4f7e5c57405effdb8c604c7390512f50d7ad53b3d52b8dbe8e630110b7fbff1859a
-
SSDEEP
12288:UU5rCOTeiDxi5bwRlY4OOnigSoLBnpf5I3INZ:UUQOJDxWbgTn5ScBnpf5I4N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2748 8750.tmp 5104 87DD.tmp 1352 8889.tmp 4748 8906.tmp 4672 8954.tmp 2152 89C1.tmp 396 8A3E.tmp 4948 8A9C.tmp 1428 8AFA.tmp 4908 8B58.tmp 112 8BB5.tmp 860 8C61.tmp 2356 8CCF.tmp 4620 8D2C.tmp 4628 8D8A.tmp 4652 8DF8.tmp 5056 8E84.tmp 4996 8EF2.tmp 808 8F5F.tmp 2256 8FCC.tmp 1052 9049.tmp 2964 90B7.tmp 812 9124.tmp 868 91A1.tmp 4824 920E.tmp 1948 92AB.tmp 528 9337.tmp 548 93B4.tmp 4512 9431.tmp 3516 947F.tmp 4336 951C.tmp 3664 9589.tmp 1592 9606.tmp 1344 9664.tmp 4936 96C2.tmp 2156 9710.tmp 2480 975E.tmp 1020 97BC.tmp 3540 9829.tmp 4312 9887.tmp 4452 98E4.tmp 3504 9942.tmp 4864 99B0.tmp 1472 9A2D.tmp 3544 9A7B.tmp 1908 9AD8.tmp 3480 9B27.tmp 2060 9B84.tmp 1608 9BE2.tmp 1352 9C4F.tmp 4748 9CAD.tmp 2340 9D0B.tmp 2088 9D69.tmp 2152 9DC6.tmp 3608 9E15.tmp 1492 9E72.tmp 3012 9ED0.tmp 212 9F2E.tmp 1228 9F9B.tmp 2104 9FF9.tmp 1120 A047.tmp 3104 A095.tmp 432 A0E3.tmp 2264 A131.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3660 wrote to memory of 2748 3660 2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe 83 PID 3660 wrote to memory of 2748 3660 2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe 83 PID 3660 wrote to memory of 2748 3660 2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe 83 PID 2748 wrote to memory of 5104 2748 8750.tmp 84 PID 2748 wrote to memory of 5104 2748 8750.tmp 84 PID 2748 wrote to memory of 5104 2748 8750.tmp 84 PID 5104 wrote to memory of 1352 5104 87DD.tmp 87 PID 5104 wrote to memory of 1352 5104 87DD.tmp 87 PID 5104 wrote to memory of 1352 5104 87DD.tmp 87 PID 1352 wrote to memory of 4748 1352 8889.tmp 88 PID 1352 wrote to memory of 4748 1352 8889.tmp 88 PID 1352 wrote to memory of 4748 1352 8889.tmp 88 PID 4748 wrote to memory of 4672 4748 8906.tmp 89 PID 4748 wrote to memory of 4672 4748 8906.tmp 89 PID 4748 wrote to memory of 4672 4748 8906.tmp 89 PID 4672 wrote to memory of 2152 4672 8954.tmp 90 PID 4672 wrote to memory of 2152 4672 8954.tmp 90 PID 4672 wrote to memory of 2152 4672 8954.tmp 90 PID 2152 wrote to memory of 396 2152 89C1.tmp 91 PID 2152 wrote to memory of 396 2152 89C1.tmp 91 PID 2152 wrote to memory of 396 2152 89C1.tmp 91 PID 396 wrote to memory of 4948 396 8A3E.tmp 92 PID 396 wrote to memory of 4948 396 8A3E.tmp 92 PID 396 wrote to memory of 4948 396 8A3E.tmp 92 PID 4948 wrote to memory of 1428 4948 8A9C.tmp 93 PID 4948 wrote to memory of 1428 4948 8A9C.tmp 93 PID 4948 wrote to memory of 1428 4948 8A9C.tmp 93 PID 1428 wrote to memory of 4908 1428 8AFA.tmp 94 PID 1428 wrote to memory of 4908 1428 8AFA.tmp 94 PID 1428 wrote to memory of 4908 1428 8AFA.tmp 94 PID 4908 wrote to memory of 112 4908 8B58.tmp 95 PID 4908 wrote to memory of 112 4908 8B58.tmp 95 PID 4908 wrote to memory of 112 4908 8B58.tmp 95 PID 112 wrote to memory of 860 112 8BB5.tmp 96 PID 112 wrote to memory of 860 112 8BB5.tmp 96 PID 112 wrote to memory of 860 112 8BB5.tmp 96 PID 860 wrote to memory of 2356 860 8C61.tmp 97 PID 860 wrote to memory of 2356 860 8C61.tmp 97 PID 860 wrote to memory of 2356 860 8C61.tmp 97 PID 2356 wrote to memory of 4620 2356 8CCF.tmp 98 PID 2356 wrote to memory of 4620 2356 8CCF.tmp 98 PID 2356 wrote to memory of 4620 2356 8CCF.tmp 98 PID 4620 wrote to memory of 4628 4620 8D2C.tmp 99 PID 4620 wrote to memory of 4628 4620 8D2C.tmp 99 PID 4620 wrote to memory of 4628 4620 8D2C.tmp 99 PID 4628 wrote to memory of 4652 4628 8D8A.tmp 100 PID 4628 wrote to memory of 4652 4628 8D8A.tmp 100 PID 4628 wrote to memory of 4652 4628 8D8A.tmp 100 PID 4652 wrote to memory of 5056 4652 8DF8.tmp 101 PID 4652 wrote to memory of 5056 4652 8DF8.tmp 101 PID 4652 wrote to memory of 5056 4652 8DF8.tmp 101 PID 5056 wrote to memory of 4996 5056 8E84.tmp 102 PID 5056 wrote to memory of 4996 5056 8E84.tmp 102 PID 5056 wrote to memory of 4996 5056 8E84.tmp 102 PID 4996 wrote to memory of 808 4996 8EF2.tmp 103 PID 4996 wrote to memory of 808 4996 8EF2.tmp 103 PID 4996 wrote to memory of 808 4996 8EF2.tmp 103 PID 808 wrote to memory of 2256 808 8F5F.tmp 104 PID 808 wrote to memory of 2256 808 8F5F.tmp 104 PID 808 wrote to memory of 2256 808 8F5F.tmp 104 PID 2256 wrote to memory of 1052 2256 8FCC.tmp 105 PID 2256 wrote to memory of 1052 2256 8FCC.tmp 105 PID 2256 wrote to memory of 1052 2256 8FCC.tmp 105 PID 1052 wrote to memory of 2964 1052 9049.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"23⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"24⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"25⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"26⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"27⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"28⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"29⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"30⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"31⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"32⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"33⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"34⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"35⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"36⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"37⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"38⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"39⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"40⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"41⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"42⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"43⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"44⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"45⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"46⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"47⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"48⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"49⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"50⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"51⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"52⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"53⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"54⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"55⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"56⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"57⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"58⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"59⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"60⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"61⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"62⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"63⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"64⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"65⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"66⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"67⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"68⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"69⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"70⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"71⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"72⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"73⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"74⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"75⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"76⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"77⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"78⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"79⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"80⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"81⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"82⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"83⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"84⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"85⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"86⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"87⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"88⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"89⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"90⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"91⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"92⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"93⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"94⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"95⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"96⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"97⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"98⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"99⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"100⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"101⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"102⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"103⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"104⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"105⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"106⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"107⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"108⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"109⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"110⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"111⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"112⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"113⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"114⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"115⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"116⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"117⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"118⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"119⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"120⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"121⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"122⤵PID:1608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-