Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 05:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-11_947b670e5f9505c952589084fb80aa25_mafia.exe
Resource
win7-20240708-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-11_947b670e5f9505c952589084fb80aa25_mafia.exe
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
2024-07-11_947b670e5f9505c952589084fb80aa25_mafia.exe
-
Size
712KB
-
MD5
947b670e5f9505c952589084fb80aa25
-
SHA1
86ecb60cfd7bda3cdfddecf20444421f7ebd2321
-
SHA256
47cfcffed2a565d0426abfc9ef48794687f004ff135ad1653ca4be1b7f79d11b
-
SHA512
b34fb724e9fecb107f3c059afbb9909a726ce6a1aa5f085f2b604819310ebf22ba4a8cc2e0e3caa125eabadea9b003a4affecb3c2b6a06d892cc5cebb8625b8e
-
SSDEEP
12288:FU5rCOTeiDTYvFY8FV+R5Uw8RImL9NZu+foA1bUNZdCvq5TJLCvY90D8/LVBlVkQ:FUQOJDkrORF9m5X1QNnCvq5TJLCvY90E
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4336 72AF.tmp 2176 737A.tmp 5104 7407.tmp 4908 74B3.tmp 1624 756E.tmp 3720 761A.tmp 1052 76C6.tmp 2808 7772.tmp 632 77EF.tmp 4364 789B.tmp 8 7908.tmp 4620 7985.tmp 900 79F3.tmp 2636 7A60.tmp 544 7B0C.tmp 4028 7BC7.tmp 3108 7C64.tmp 1824 7D00.tmp 3456 7D7D.tmp 4672 7DFA.tmp 4612 7E96.tmp 3176 7F52.tmp 1360 7FBF.tmp 1936 806B.tmp 3440 8146.tmp 1552 81C3.tmp 1828 825F.tmp 776 82EB.tmp 3496 8368.tmp 1944 8424.tmp 3024 84B1.tmp 5084 852E.tmp 3868 85D9.tmp 3788 8628.tmp 1396 8676.tmp 2676 86D3.tmp 3068 8731.tmp 1688 878F.tmp 2736 87ED.tmp 636 884A.tmp 3420 88A8.tmp 2436 8906.tmp 4224 8964.tmp 4368 89C1.tmp 1992 8A1F.tmp 4000 8A8D.tmp 1208 8AFA.tmp 3536 8B58.tmp 2740 8BA6.tmp 3768 8C04.tmp 4440 8C71.tmp 2692 8CBF.tmp 1852 8D0D.tmp 2380 8D5B.tmp 3408 8DB9.tmp 208 8E17.tmp 2476 8E75.tmp 4884 8EC3.tmp 2228 8F20.tmp 3216 8F7E.tmp 2464 8FCC.tmp 552 901A.tmp 3396 9078.tmp 4232 90D6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3620 wrote to memory of 4336 3620 2024-07-11_947b670e5f9505c952589084fb80aa25_mafia.exe 84 PID 3620 wrote to memory of 4336 3620 2024-07-11_947b670e5f9505c952589084fb80aa25_mafia.exe 84 PID 3620 wrote to memory of 4336 3620 2024-07-11_947b670e5f9505c952589084fb80aa25_mafia.exe 84 PID 4336 wrote to memory of 2176 4336 72AF.tmp 86 PID 4336 wrote to memory of 2176 4336 72AF.tmp 86 PID 4336 wrote to memory of 2176 4336 72AF.tmp 86 PID 2176 wrote to memory of 5104 2176 737A.tmp 88 PID 2176 wrote to memory of 5104 2176 737A.tmp 88 PID 2176 wrote to memory of 5104 2176 737A.tmp 88 PID 5104 wrote to memory of 4908 5104 7407.tmp 89 PID 5104 wrote to memory of 4908 5104 7407.tmp 89 PID 5104 wrote to memory of 4908 5104 7407.tmp 89 PID 4908 wrote to memory of 1624 4908 74B3.tmp 90 PID 4908 wrote to memory of 1624 4908 74B3.tmp 90 PID 4908 wrote to memory of 1624 4908 74B3.tmp 90 PID 1624 wrote to memory of 3720 1624 756E.tmp 91 PID 1624 wrote to memory of 3720 1624 756E.tmp 91 PID 1624 wrote to memory of 3720 1624 756E.tmp 91 PID 3720 wrote to memory of 1052 3720 761A.tmp 92 PID 3720 wrote to memory of 1052 3720 761A.tmp 92 PID 3720 wrote to memory of 1052 3720 761A.tmp 92 PID 1052 wrote to memory of 2808 1052 76C6.tmp 93 PID 1052 wrote to memory of 2808 1052 76C6.tmp 93 PID 1052 wrote to memory of 2808 1052 76C6.tmp 93 PID 2808 wrote to memory of 632 2808 7772.tmp 94 PID 2808 wrote to memory of 632 2808 7772.tmp 94 PID 2808 wrote to memory of 632 2808 7772.tmp 94 PID 632 wrote to memory of 4364 632 77EF.tmp 95 PID 632 wrote to memory of 4364 632 77EF.tmp 95 PID 632 wrote to memory of 4364 632 77EF.tmp 95 PID 4364 wrote to memory of 8 4364 789B.tmp 96 PID 4364 wrote to memory of 8 4364 789B.tmp 96 PID 4364 wrote to memory of 8 4364 789B.tmp 96 PID 8 wrote to memory of 4620 8 7908.tmp 97 PID 8 wrote to memory of 4620 8 7908.tmp 97 PID 8 wrote to memory of 4620 8 7908.tmp 97 PID 4620 wrote to memory of 900 4620 7985.tmp 98 PID 4620 wrote to memory of 900 4620 7985.tmp 98 PID 4620 wrote to memory of 900 4620 7985.tmp 98 PID 900 wrote to memory of 2636 900 79F3.tmp 99 PID 900 wrote to memory of 2636 900 79F3.tmp 99 PID 900 wrote to memory of 2636 900 79F3.tmp 99 PID 2636 wrote to memory of 544 2636 7A60.tmp 100 PID 2636 wrote to memory of 544 2636 7A60.tmp 100 PID 2636 wrote to memory of 544 2636 7A60.tmp 100 PID 544 wrote to memory of 4028 544 7B0C.tmp 101 PID 544 wrote to memory of 4028 544 7B0C.tmp 101 PID 544 wrote to memory of 4028 544 7B0C.tmp 101 PID 4028 wrote to memory of 3108 4028 7BC7.tmp 102 PID 4028 wrote to memory of 3108 4028 7BC7.tmp 102 PID 4028 wrote to memory of 3108 4028 7BC7.tmp 102 PID 3108 wrote to memory of 1824 3108 7C64.tmp 103 PID 3108 wrote to memory of 1824 3108 7C64.tmp 103 PID 3108 wrote to memory of 1824 3108 7C64.tmp 103 PID 1824 wrote to memory of 3456 1824 7D00.tmp 104 PID 1824 wrote to memory of 3456 1824 7D00.tmp 104 PID 1824 wrote to memory of 3456 1824 7D00.tmp 104 PID 3456 wrote to memory of 4672 3456 7D7D.tmp 105 PID 3456 wrote to memory of 4672 3456 7D7D.tmp 105 PID 3456 wrote to memory of 4672 3456 7D7D.tmp 105 PID 4672 wrote to memory of 4612 4672 7DFA.tmp 106 PID 4672 wrote to memory of 4612 4672 7DFA.tmp 106 PID 4672 wrote to memory of 4612 4672 7DFA.tmp 106 PID 4612 wrote to memory of 3176 4612 7E96.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-11_947b670e5f9505c952589084fb80aa25_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-11_947b670e5f9505c952589084fb80aa25_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"23⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"24⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"25⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"26⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"27⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"28⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"29⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"30⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"31⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"32⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"33⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"34⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"35⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"36⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"37⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"38⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"39⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"40⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"41⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"42⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"43⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"44⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"45⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"46⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"47⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"48⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"49⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"50⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"51⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"52⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"53⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"54⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"55⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"56⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"57⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"58⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"59⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"60⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"61⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"62⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"63⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"64⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"65⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"66⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"67⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"68⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"69⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"70⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"71⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"72⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"73⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"74⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"75⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"76⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"77⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"78⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"79⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"80⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"81⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"82⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"83⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"84⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"85⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"86⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"87⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"88⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"89⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"90⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"91⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"92⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"93⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"94⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"95⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"96⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"97⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"98⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"99⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"100⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"101⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"102⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"103⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"104⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"105⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"106⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"107⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"108⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"109⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"110⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"111⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"112⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"113⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"114⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"115⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"116⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"117⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"118⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"119⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"120⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"121⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"122⤵PID:3768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-