Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
09-07-2024 19:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-09_818f5d2ee10fc91a331aa216db7aade6_mafia.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-09_818f5d2ee10fc91a331aa216db7aade6_mafia.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-09_818f5d2ee10fc91a331aa216db7aade6_mafia.exe
-
Size
520KB
-
MD5
818f5d2ee10fc91a331aa216db7aade6
-
SHA1
4f1cc4c5459bc68971cc0db86d974dd8baf47a52
-
SHA256
a8fa4b2a4b883c6172a5944d510af3413d126687b6b90eda42f7586857627b24
-
SHA512
c43645f4b4dc1508427968302b270d215f3ce3d6bbfcbfadf71060b511d6a3cea819601a347ae2cfabebc3c86b269166d0ac0393b340f9648b170f7098b802a6
-
SSDEEP
12288:gj8fuxR21t5i8frFFCzRo8e86CB6HG3XEQvBLNZ:gj8fuK1GYrbaR1elCB6HG3XFN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1084 855C.tmp 3568 85CA.tmp 4528 8647.tmp 4432 86E3.tmp 2324 8741.tmp 3340 87DD.tmp 3884 884A.tmp 2484 88B8.tmp 2772 8964.tmp 4404 89C1.tmp 2304 8A3E.tmp 3988 8ACB.tmp 540 8B38.tmp 3712 8B87.tmp 4356 8BD5.tmp 3596 8C61.tmp 4000 8CDE.tmp 1288 8D6B.tmp 3292 8DF8.tmp 2848 8E65.tmp 2128 8ED2.tmp 5012 8F5F.tmp 2740 8FAD.tmp 5092 902A.tmp 4452 90B7.tmp 4644 9114.tmp 4460 9182.tmp 4832 91E0.tmp 4652 924D.tmp 3544 929B.tmp 2976 9328.tmp 936 9395.tmp 3976 93E3.tmp 4632 9431.tmp 3904 948F.tmp 1064 94DD.tmp 2120 953B.tmp 3932 9589.tmp 700 95D7.tmp 1640 9635.tmp 1548 9683.tmp 2244 96E1.tmp 1388 973F.tmp 2008 978D.tmp 624 97EA.tmp 3012 9848.tmp 1136 9896.tmp 4780 98E4.tmp 4368 9942.tmp 4260 99A0.tmp 2376 99FE.tmp 3936 9A4C.tmp 1188 9A9A.tmp 4276 9AF8.tmp 3992 9B46.tmp 3572 9B84.tmp 4528 9BE2.tmp 3984 9C30.tmp 3236 9C7E.tmp 2324 9CDC.tmp 2424 9D3A.tmp 4856 9D88.tmp 1720 9DD6.tmp 2156 9E24.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1060 wrote to memory of 1084 1060 2024-07-09_818f5d2ee10fc91a331aa216db7aade6_mafia.exe 83 PID 1060 wrote to memory of 1084 1060 2024-07-09_818f5d2ee10fc91a331aa216db7aade6_mafia.exe 83 PID 1060 wrote to memory of 1084 1060 2024-07-09_818f5d2ee10fc91a331aa216db7aade6_mafia.exe 83 PID 1084 wrote to memory of 3568 1084 855C.tmp 84 PID 1084 wrote to memory of 3568 1084 855C.tmp 84 PID 1084 wrote to memory of 3568 1084 855C.tmp 84 PID 3568 wrote to memory of 4528 3568 85CA.tmp 86 PID 3568 wrote to memory of 4528 3568 85CA.tmp 86 PID 3568 wrote to memory of 4528 3568 85CA.tmp 86 PID 4528 wrote to memory of 4432 4528 8647.tmp 87 PID 4528 wrote to memory of 4432 4528 8647.tmp 87 PID 4528 wrote to memory of 4432 4528 8647.tmp 87 PID 4432 wrote to memory of 2324 4432 86E3.tmp 88 PID 4432 wrote to memory of 2324 4432 86E3.tmp 88 PID 4432 wrote to memory of 2324 4432 86E3.tmp 88 PID 2324 wrote to memory of 3340 2324 8741.tmp 89 PID 2324 wrote to memory of 3340 2324 8741.tmp 89 PID 2324 wrote to memory of 3340 2324 8741.tmp 89 PID 3340 wrote to memory of 3884 3340 87DD.tmp 90 PID 3340 wrote to memory of 3884 3340 87DD.tmp 90 PID 3340 wrote to memory of 3884 3340 87DD.tmp 90 PID 3884 wrote to memory of 2484 3884 884A.tmp 91 PID 3884 wrote to memory of 2484 3884 884A.tmp 91 PID 3884 wrote to memory of 2484 3884 884A.tmp 91 PID 2484 wrote to memory of 2772 2484 88B8.tmp 92 PID 2484 wrote to memory of 2772 2484 88B8.tmp 92 PID 2484 wrote to memory of 2772 2484 88B8.tmp 92 PID 2772 wrote to memory of 4404 2772 8964.tmp 93 PID 2772 wrote to memory of 4404 2772 8964.tmp 93 PID 2772 wrote to memory of 4404 2772 8964.tmp 93 PID 4404 wrote to memory of 2304 4404 89C1.tmp 94 PID 4404 wrote to memory of 2304 4404 89C1.tmp 94 PID 4404 wrote to memory of 2304 4404 89C1.tmp 94 PID 2304 wrote to memory of 3988 2304 8A3E.tmp 95 PID 2304 wrote to memory of 3988 2304 8A3E.tmp 95 PID 2304 wrote to memory of 3988 2304 8A3E.tmp 95 PID 3988 wrote to memory of 540 3988 8ACB.tmp 96 PID 3988 wrote to memory of 540 3988 8ACB.tmp 96 PID 3988 wrote to memory of 540 3988 8ACB.tmp 96 PID 540 wrote to memory of 3712 540 8B38.tmp 97 PID 540 wrote to memory of 3712 540 8B38.tmp 97 PID 540 wrote to memory of 3712 540 8B38.tmp 97 PID 3712 wrote to memory of 4356 3712 8B87.tmp 98 PID 3712 wrote to memory of 4356 3712 8B87.tmp 98 PID 3712 wrote to memory of 4356 3712 8B87.tmp 98 PID 4356 wrote to memory of 3596 4356 8BD5.tmp 99 PID 4356 wrote to memory of 3596 4356 8BD5.tmp 99 PID 4356 wrote to memory of 3596 4356 8BD5.tmp 99 PID 3596 wrote to memory of 4000 3596 8C61.tmp 100 PID 3596 wrote to memory of 4000 3596 8C61.tmp 100 PID 3596 wrote to memory of 4000 3596 8C61.tmp 100 PID 4000 wrote to memory of 1288 4000 8CDE.tmp 101 PID 4000 wrote to memory of 1288 4000 8CDE.tmp 101 PID 4000 wrote to memory of 1288 4000 8CDE.tmp 101 PID 1288 wrote to memory of 3292 1288 8D6B.tmp 102 PID 1288 wrote to memory of 3292 1288 8D6B.tmp 102 PID 1288 wrote to memory of 3292 1288 8D6B.tmp 102 PID 3292 wrote to memory of 2848 3292 8DF8.tmp 103 PID 3292 wrote to memory of 2848 3292 8DF8.tmp 103 PID 3292 wrote to memory of 2848 3292 8DF8.tmp 103 PID 2848 wrote to memory of 2128 2848 8E65.tmp 104 PID 2848 wrote to memory of 2128 2848 8E65.tmp 104 PID 2848 wrote to memory of 2128 2848 8E65.tmp 104 PID 2128 wrote to memory of 5012 2128 8ED2.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-09_818f5d2ee10fc91a331aa216db7aade6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-09_818f5d2ee10fc91a331aa216db7aade6_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"23⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"24⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"25⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"26⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"27⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"28⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"29⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"30⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"31⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"32⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"33⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"34⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"35⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"36⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"37⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"38⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"39⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"40⤵
- Executes dropped EXE
PID:700 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"41⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"42⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"43⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"44⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"45⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"46⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"47⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"48⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"49⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"50⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"51⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"52⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"53⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"54⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"55⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"56⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"57⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"58⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"59⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"60⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"61⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"62⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"63⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"64⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"65⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"66⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"67⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"68⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"69⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"70⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"71⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"72⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"73⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"74⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"75⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"76⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"77⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"78⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"79⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"80⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"81⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"82⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"83⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"84⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"85⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"86⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"87⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"88⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"89⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"90⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"91⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"92⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"93⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"94⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"95⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"96⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"97⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"98⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"99⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"100⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"101⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"102⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"103⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"104⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"105⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"106⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"107⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"108⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"109⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"110⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"111⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"112⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"113⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"114⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"115⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"116⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"117⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"118⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"119⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"120⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"121⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"122⤵PID:2504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-