Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240708-en -
resource tags
arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 07:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-09_3e73b1883a6f19eec09386a73bf20682_mafia.exe
Resource
win7-20240708-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-09_3e73b1883a6f19eec09386a73bf20682_mafia.exe
Resource
win10v2004-20240708-en
2 signatures
150 seconds
General
-
Target
2024-07-09_3e73b1883a6f19eec09386a73bf20682_mafia.exe
-
Size
765KB
-
MD5
3e73b1883a6f19eec09386a73bf20682
-
SHA1
11fc6589606b1d183c0dd51fe8601cec448dbe52
-
SHA256
0e590ed89a9571d61411d960cb95752bdc0d351eec3a5d9c5a3ecdb72ee0d91c
-
SHA512
ebf792a0c231a5eb1aa6b3ac3dac333ff542d75c783d83d15ddc87566b9a27a2563853d59b77a5d02e9e7c1af48d0a092aeb69789758c0b18b81fb4c00ac41c6
-
SSDEEP
12288:ZU5rCOTeiDhDK2/DXgamK+m+TIfP3ZF5rn5rLOa54U5w5A:ZUQOJDhFzapIX3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2432 1836.tmp 3772 18B3.tmp 3516 1940.tmp 864 1A2A.tmp 1584 1AB7.tmp 2288 1BB1.tmp 1784 1C5D.tmp 2000 1CF9.tmp 4932 1D95.tmp 1924 1E31.tmp 3604 1EBE.tmp 1592 1F1C.tmp 4980 1F99.tmp 3524 2006.tmp 1424 2093.tmp 2400 213F.tmp 4740 219C.tmp 1128 2219.tmp 3884 22B6.tmp 2356 2371.tmp 4248 244C.tmp 632 24B9.tmp 368 2556.tmp 5028 25C3.tmp 2304 268E.tmp 2148 26EC.tmp 4352 2769.tmp 4344 27D6.tmp 2808 2863.tmp 1036 290F.tmp 2248 29BB.tmp 4476 2A38.tmp 2420 2AB5.tmp 1428 2B32.tmp 5096 2B80.tmp 4048 2BDD.tmp 1868 2C3B.tmp 2860 2C99.tmp 4576 2CF7.tmp 1620 2D45.tmp 3720 2DA3.tmp 2744 2DF1.tmp 3120 2E4E.tmp 536 2EBC.tmp 3588 2F29.tmp 2580 2F87.tmp 1960 2FF4.tmp 4984 3052.tmp 4240 30B0.tmp 412 311D.tmp 1200 318B.tmp 888 31E8.tmp 3896 3256.tmp 3612 32C3.tmp 4428 3330.tmp 1400 339E.tmp 1896 33FC.tmp 3468 3469.tmp 1628 34C7.tmp 1092 3534.tmp 2748 35A1.tmp 3752 360F.tmp 384 367C.tmp 2980 36DA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4744 wrote to memory of 2432 4744 2024-07-09_3e73b1883a6f19eec09386a73bf20682_mafia.exe 83 PID 4744 wrote to memory of 2432 4744 2024-07-09_3e73b1883a6f19eec09386a73bf20682_mafia.exe 83 PID 4744 wrote to memory of 2432 4744 2024-07-09_3e73b1883a6f19eec09386a73bf20682_mafia.exe 83 PID 2432 wrote to memory of 3772 2432 1836.tmp 84 PID 2432 wrote to memory of 3772 2432 1836.tmp 84 PID 2432 wrote to memory of 3772 2432 1836.tmp 84 PID 3772 wrote to memory of 3516 3772 18B3.tmp 86 PID 3772 wrote to memory of 3516 3772 18B3.tmp 86 PID 3772 wrote to memory of 3516 3772 18B3.tmp 86 PID 3516 wrote to memory of 864 3516 1940.tmp 87 PID 3516 wrote to memory of 864 3516 1940.tmp 87 PID 3516 wrote to memory of 864 3516 1940.tmp 87 PID 864 wrote to memory of 1584 864 1A2A.tmp 88 PID 864 wrote to memory of 1584 864 1A2A.tmp 88 PID 864 wrote to memory of 1584 864 1A2A.tmp 88 PID 1584 wrote to memory of 2288 1584 1AB7.tmp 89 PID 1584 wrote to memory of 2288 1584 1AB7.tmp 89 PID 1584 wrote to memory of 2288 1584 1AB7.tmp 89 PID 2288 wrote to memory of 1784 2288 1BB1.tmp 90 PID 2288 wrote to memory of 1784 2288 1BB1.tmp 90 PID 2288 wrote to memory of 1784 2288 1BB1.tmp 90 PID 1784 wrote to memory of 2000 1784 1C5D.tmp 91 PID 1784 wrote to memory of 2000 1784 1C5D.tmp 91 PID 1784 wrote to memory of 2000 1784 1C5D.tmp 91 PID 2000 wrote to memory of 4932 2000 1CF9.tmp 92 PID 2000 wrote to memory of 4932 2000 1CF9.tmp 92 PID 2000 wrote to memory of 4932 2000 1CF9.tmp 92 PID 4932 wrote to memory of 1924 4932 1D95.tmp 93 PID 4932 wrote to memory of 1924 4932 1D95.tmp 93 PID 4932 wrote to memory of 1924 4932 1D95.tmp 93 PID 1924 wrote to memory of 3604 1924 1E31.tmp 94 PID 1924 wrote to memory of 3604 1924 1E31.tmp 94 PID 1924 wrote to memory of 3604 1924 1E31.tmp 94 PID 3604 wrote to memory of 1592 3604 1EBE.tmp 95 PID 3604 wrote to memory of 1592 3604 1EBE.tmp 95 PID 3604 wrote to memory of 1592 3604 1EBE.tmp 95 PID 1592 wrote to memory of 4980 1592 1F1C.tmp 96 PID 1592 wrote to memory of 4980 1592 1F1C.tmp 96 PID 1592 wrote to memory of 4980 1592 1F1C.tmp 96 PID 4980 wrote to memory of 3524 4980 1F99.tmp 97 PID 4980 wrote to memory of 3524 4980 1F99.tmp 97 PID 4980 wrote to memory of 3524 4980 1F99.tmp 97 PID 3524 wrote to memory of 1424 3524 2006.tmp 98 PID 3524 wrote to memory of 1424 3524 2006.tmp 98 PID 3524 wrote to memory of 1424 3524 2006.tmp 98 PID 1424 wrote to memory of 2400 1424 2093.tmp 99 PID 1424 wrote to memory of 2400 1424 2093.tmp 99 PID 1424 wrote to memory of 2400 1424 2093.tmp 99 PID 2400 wrote to memory of 4740 2400 213F.tmp 100 PID 2400 wrote to memory of 4740 2400 213F.tmp 100 PID 2400 wrote to memory of 4740 2400 213F.tmp 100 PID 4740 wrote to memory of 1128 4740 219C.tmp 101 PID 4740 wrote to memory of 1128 4740 219C.tmp 101 PID 4740 wrote to memory of 1128 4740 219C.tmp 101 PID 1128 wrote to memory of 3884 1128 2219.tmp 102 PID 1128 wrote to memory of 3884 1128 2219.tmp 102 PID 1128 wrote to memory of 3884 1128 2219.tmp 102 PID 3884 wrote to memory of 2356 3884 22B6.tmp 103 PID 3884 wrote to memory of 2356 3884 22B6.tmp 103 PID 3884 wrote to memory of 2356 3884 22B6.tmp 103 PID 2356 wrote to memory of 4248 2356 2371.tmp 104 PID 2356 wrote to memory of 4248 2356 2371.tmp 104 PID 2356 wrote to memory of 4248 2356 2371.tmp 104 PID 4248 wrote to memory of 632 4248 244C.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-09_3e73b1883a6f19eec09386a73bf20682_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-09_3e73b1883a6f19eec09386a73bf20682_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\18B3.tmp"C:\Users\Admin\AppData\Local\Temp\18B3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\1940.tmp"C:\Users\Admin\AppData\Local\Temp\1940.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\1E31.tmp"C:\Users\Admin\AppData\Local\Temp\1E31.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\2006.tmp"C:\Users\Admin\AppData\Local\Temp\2006.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\219C.tmp"C:\Users\Admin\AppData\Local\Temp\219C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\2219.tmp"C:\Users\Admin\AppData\Local\Temp\2219.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\22B6.tmp"C:\Users\Admin\AppData\Local\Temp\22B6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\2371.tmp"C:\Users\Admin\AppData\Local\Temp\2371.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\244C.tmp"C:\Users\Admin\AppData\Local\Temp\244C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\24B9.tmp"C:\Users\Admin\AppData\Local\Temp\24B9.tmp"23⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\2556.tmp"C:\Users\Admin\AppData\Local\Temp\2556.tmp"24⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\25C3.tmp"C:\Users\Admin\AppData\Local\Temp\25C3.tmp"25⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\268E.tmp"C:\Users\Admin\AppData\Local\Temp\268E.tmp"26⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"27⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\2769.tmp"C:\Users\Admin\AppData\Local\Temp\2769.tmp"28⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\27D6.tmp"C:\Users\Admin\AppData\Local\Temp\27D6.tmp"29⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\2863.tmp"C:\Users\Admin\AppData\Local\Temp\2863.tmp"30⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"31⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"32⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\2A38.tmp"C:\Users\Admin\AppData\Local\Temp\2A38.tmp"33⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"34⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"35⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\2B80.tmp"C:\Users\Admin\AppData\Local\Temp\2B80.tmp"36⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"37⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"38⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\2C99.tmp"C:\Users\Admin\AppData\Local\Temp\2C99.tmp"39⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"40⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\2D45.tmp"C:\Users\Admin\AppData\Local\Temp\2D45.tmp"41⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"42⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"43⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"44⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"45⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"46⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"47⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"48⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"49⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"50⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\311D.tmp"C:\Users\Admin\AppData\Local\Temp\311D.tmp"51⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"52⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\31E8.tmp"C:\Users\Admin\AppData\Local\Temp\31E8.tmp"53⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"54⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"55⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\3330.tmp"C:\Users\Admin\AppData\Local\Temp\3330.tmp"56⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"57⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"58⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"59⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\34C7.tmp"C:\Users\Admin\AppData\Local\Temp\34C7.tmp"60⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"61⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"62⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\360F.tmp"C:\Users\Admin\AppData\Local\Temp\360F.tmp"63⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\367C.tmp"C:\Users\Admin\AppData\Local\Temp\367C.tmp"64⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\36DA.tmp"C:\Users\Admin\AppData\Local\Temp\36DA.tmp"65⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\3747.tmp"C:\Users\Admin\AppData\Local\Temp\3747.tmp"66⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"67⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\3812.tmp"C:\Users\Admin\AppData\Local\Temp\3812.tmp"68⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\3870.tmp"C:\Users\Admin\AppData\Local\Temp\3870.tmp"69⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\38DE.tmp"C:\Users\Admin\AppData\Local\Temp\38DE.tmp"70⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\394B.tmp"C:\Users\Admin\AppData\Local\Temp\394B.tmp"71⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\39B8.tmp"C:\Users\Admin\AppData\Local\Temp\39B8.tmp"72⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\3A16.tmp"C:\Users\Admin\AppData\Local\Temp\3A16.tmp"73⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\3A74.tmp"C:\Users\Admin\AppData\Local\Temp\3A74.tmp"74⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"75⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\3B20.tmp"C:\Users\Admin\AppData\Local\Temp\3B20.tmp"76⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"77⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"78⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\3C39.tmp"C:\Users\Admin\AppData\Local\Temp\3C39.tmp"79⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"80⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"81⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\3D62.tmp"C:\Users\Admin\AppData\Local\Temp\3D62.tmp"82⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"83⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"84⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"85⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"86⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\3F56.tmp"C:\Users\Admin\AppData\Local\Temp\3F56.tmp"87⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"88⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\4011.tmp"C:\Users\Admin\AppData\Local\Temp\4011.tmp"89⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\406F.tmp"C:\Users\Admin\AppData\Local\Temp\406F.tmp"90⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\40CD.tmp"C:\Users\Admin\AppData\Local\Temp\40CD.tmp"91⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\413A.tmp"C:\Users\Admin\AppData\Local\Temp\413A.tmp"92⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"93⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\41F6.tmp"C:\Users\Admin\AppData\Local\Temp\41F6.tmp"94⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\4253.tmp"C:\Users\Admin\AppData\Local\Temp\4253.tmp"95⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\42C1.tmp"C:\Users\Admin\AppData\Local\Temp\42C1.tmp"96⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"97⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\439C.tmp"C:\Users\Admin\AppData\Local\Temp\439C.tmp"98⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\43F9.tmp"C:\Users\Admin\AppData\Local\Temp\43F9.tmp"99⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"100⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\44C4.tmp"C:\Users\Admin\AppData\Local\Temp\44C4.tmp"101⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\4532.tmp"C:\Users\Admin\AppData\Local\Temp\4532.tmp"102⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\4590.tmp"C:\Users\Admin\AppData\Local\Temp\4590.tmp"103⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\45FD.tmp"C:\Users\Admin\AppData\Local\Temp\45FD.tmp"104⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\464B.tmp"C:\Users\Admin\AppData\Local\Temp\464B.tmp"105⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\46C8.tmp"C:\Users\Admin\AppData\Local\Temp\46C8.tmp"106⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\4735.tmp"C:\Users\Admin\AppData\Local\Temp\4735.tmp"107⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"108⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\4801.tmp"C:\Users\Admin\AppData\Local\Temp\4801.tmp"109⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\485E.tmp"C:\Users\Admin\AppData\Local\Temp\485E.tmp"110⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\48CC.tmp"C:\Users\Admin\AppData\Local\Temp\48CC.tmp"111⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\4929.tmp"C:\Users\Admin\AppData\Local\Temp\4929.tmp"112⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\4987.tmp"C:\Users\Admin\AppData\Local\Temp\4987.tmp"113⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\49E5.tmp"C:\Users\Admin\AppData\Local\Temp\49E5.tmp"114⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\4A52.tmp"C:\Users\Admin\AppData\Local\Temp\4A52.tmp"115⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"116⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"117⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"118⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"119⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\4C46.tmp"C:\Users\Admin\AppData\Local\Temp\4C46.tmp"120⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"121⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"122⤵PID:4596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-