Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22-07-2024 16:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-22_6499327d76cb4c4e40e9646b20628a3f_mafia.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-22_6499327d76cb4c4e40e9646b20628a3f_mafia.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-22_6499327d76cb4c4e40e9646b20628a3f_mafia.exe
-
Size
486KB
-
MD5
6499327d76cb4c4e40e9646b20628a3f
-
SHA1
6efb93e191e850c49ff73890a628020c1c9b5b58
-
SHA256
58c7eda67c5da8f6ece5391e64ebe9dd9a20dab5efd5b72e9acfd8c219a4674f
-
SHA512
ae171a972b3bb1a9334523f3632a0a204333dfb9a20c847e11b8ee34be43f2844f1e266bdc2e8da8dbfd9f9026c5eb7e1965307c038b76cc3c04208a5265370b
-
SSDEEP
12288:/U5rCOTeiDpI07fl50sQQDnLovbxjJYRNZ:/UQOJDpI07v2KLovFjSRN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3752 7203.tmp 1920 7271.tmp 5076 72DE.tmp 3576 734B.tmp 5032 73B9.tmp 2916 7407.tmp 4876 7465.tmp 3172 74D2.tmp 5068 7530.tmp 3276 757E.tmp 3180 75CC.tmp 1872 7639.tmp 4888 7688.tmp 1676 76D6.tmp 4900 7733.tmp 4376 7791.tmp 3764 77EF.tmp 2520 785C.tmp 4708 78D9.tmp 4372 7947.tmp 4380 7995.tmp 396 79E3.tmp 1008 7A31.tmp 2144 7A8F.tmp 2456 7AFC.tmp 3904 7B5A.tmp 3208 7BD7.tmp 1396 7C44.tmp 2728 7CB2.tmp 4512 7D0F.tmp 2436 7D7D.tmp 812 7DCB.tmp 5096 7E48.tmp 4188 7E96.tmp 3596 7EF4.tmp 4768 7F42.tmp 4220 7F90.tmp 4424 7FDE.tmp 1364 802C.tmp 1532 80A9.tmp 2232 8107.tmp 376 8165.tmp 1656 81B3.tmp 4556 8211.tmp 2056 825F.tmp 2952 82BD.tmp 2316 830B.tmp 388 8368.tmp 4060 83B7.tmp 1528 8414.tmp 5068 8472.tmp 3996 84D0.tmp 3164 851E.tmp 3696 857C.tmp 2448 85CA.tmp 3048 8628.tmp 1780 8685.tmp 1676 86E3.tmp 3296 8741.tmp 3040 878F.tmp 1632 87DD.tmp 888 883B.tmp 212 8889.tmp 4508 88F6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4572 wrote to memory of 3752 4572 2024-07-22_6499327d76cb4c4e40e9646b20628a3f_mafia.exe 84 PID 4572 wrote to memory of 3752 4572 2024-07-22_6499327d76cb4c4e40e9646b20628a3f_mafia.exe 84 PID 4572 wrote to memory of 3752 4572 2024-07-22_6499327d76cb4c4e40e9646b20628a3f_mafia.exe 84 PID 3752 wrote to memory of 1920 3752 7203.tmp 85 PID 3752 wrote to memory of 1920 3752 7203.tmp 85 PID 3752 wrote to memory of 1920 3752 7203.tmp 85 PID 1920 wrote to memory of 5076 1920 7271.tmp 87 PID 1920 wrote to memory of 5076 1920 7271.tmp 87 PID 1920 wrote to memory of 5076 1920 7271.tmp 87 PID 5076 wrote to memory of 3576 5076 72DE.tmp 89 PID 5076 wrote to memory of 3576 5076 72DE.tmp 89 PID 5076 wrote to memory of 3576 5076 72DE.tmp 89 PID 3576 wrote to memory of 5032 3576 734B.tmp 91 PID 3576 wrote to memory of 5032 3576 734B.tmp 91 PID 3576 wrote to memory of 5032 3576 734B.tmp 91 PID 5032 wrote to memory of 2916 5032 73B9.tmp 92 PID 5032 wrote to memory of 2916 5032 73B9.tmp 92 PID 5032 wrote to memory of 2916 5032 73B9.tmp 92 PID 2916 wrote to memory of 4876 2916 7407.tmp 93 PID 2916 wrote to memory of 4876 2916 7407.tmp 93 PID 2916 wrote to memory of 4876 2916 7407.tmp 93 PID 4876 wrote to memory of 3172 4876 7465.tmp 94 PID 4876 wrote to memory of 3172 4876 7465.tmp 94 PID 4876 wrote to memory of 3172 4876 7465.tmp 94 PID 3172 wrote to memory of 5068 3172 74D2.tmp 95 PID 3172 wrote to memory of 5068 3172 74D2.tmp 95 PID 3172 wrote to memory of 5068 3172 74D2.tmp 95 PID 5068 wrote to memory of 3276 5068 7530.tmp 96 PID 5068 wrote to memory of 3276 5068 7530.tmp 96 PID 5068 wrote to memory of 3276 5068 7530.tmp 96 PID 3276 wrote to memory of 3180 3276 757E.tmp 97 PID 3276 wrote to memory of 3180 3276 757E.tmp 97 PID 3276 wrote to memory of 3180 3276 757E.tmp 97 PID 3180 wrote to memory of 1872 3180 75CC.tmp 98 PID 3180 wrote to memory of 1872 3180 75CC.tmp 98 PID 3180 wrote to memory of 1872 3180 75CC.tmp 98 PID 1872 wrote to memory of 4888 1872 7639.tmp 99 PID 1872 wrote to memory of 4888 1872 7639.tmp 99 PID 1872 wrote to memory of 4888 1872 7639.tmp 99 PID 4888 wrote to memory of 1676 4888 7688.tmp 100 PID 4888 wrote to memory of 1676 4888 7688.tmp 100 PID 4888 wrote to memory of 1676 4888 7688.tmp 100 PID 1676 wrote to memory of 4900 1676 76D6.tmp 101 PID 1676 wrote to memory of 4900 1676 76D6.tmp 101 PID 1676 wrote to memory of 4900 1676 76D6.tmp 101 PID 4900 wrote to memory of 4376 4900 7733.tmp 102 PID 4900 wrote to memory of 4376 4900 7733.tmp 102 PID 4900 wrote to memory of 4376 4900 7733.tmp 102 PID 4376 wrote to memory of 3764 4376 7791.tmp 103 PID 4376 wrote to memory of 3764 4376 7791.tmp 103 PID 4376 wrote to memory of 3764 4376 7791.tmp 103 PID 3764 wrote to memory of 2520 3764 77EF.tmp 104 PID 3764 wrote to memory of 2520 3764 77EF.tmp 104 PID 3764 wrote to memory of 2520 3764 77EF.tmp 104 PID 2520 wrote to memory of 4708 2520 785C.tmp 105 PID 2520 wrote to memory of 4708 2520 785C.tmp 105 PID 2520 wrote to memory of 4708 2520 785C.tmp 105 PID 4708 wrote to memory of 4372 4708 78D9.tmp 106 PID 4708 wrote to memory of 4372 4708 78D9.tmp 106 PID 4708 wrote to memory of 4372 4708 78D9.tmp 106 PID 4372 wrote to memory of 4380 4372 7947.tmp 107 PID 4372 wrote to memory of 4380 4372 7947.tmp 107 PID 4372 wrote to memory of 4380 4372 7947.tmp 107 PID 4380 wrote to memory of 396 4380 7995.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-22_6499327d76cb4c4e40e9646b20628a3f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-22_6499327d76cb4c4e40e9646b20628a3f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"23⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"24⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"25⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"26⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"27⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"28⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"29⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"30⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"31⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"32⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"33⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"34⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"35⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"36⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"37⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"38⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"39⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"40⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"41⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"42⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"43⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"44⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"45⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"46⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"47⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"48⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"49⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"50⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"51⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\8472.tmp"C:\Users\Admin\AppData\Local\Temp\8472.tmp"52⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"53⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"54⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"55⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"56⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"57⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"58⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"59⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"60⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"61⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"62⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"63⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"64⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"65⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"66⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"67⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"68⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"69⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"70⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"71⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"72⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"73⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"74⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"75⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"76⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"77⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"78⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"79⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"80⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"81⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"82⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"83⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"84⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"85⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"86⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"87⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"88⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"89⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"90⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"91⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"92⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"93⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"94⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"95⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"96⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"97⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"98⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"99⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"100⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"101⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"102⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"103⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"104⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"105⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"106⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"107⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"108⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"109⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"110⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"111⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"112⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"113⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"114⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"115⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"116⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"117⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"118⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"119⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"120⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"121⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"122⤵PID:3572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-