Analysis
-
max time kernel
151s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/02/2024, 16:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-19_9dfa2e10025fe1ca28cecc3624073784_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-19_9dfa2e10025fe1ca28cecc3624073784_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-19_9dfa2e10025fe1ca28cecc3624073784_mafia.exe
-
Size
488KB
-
MD5
9dfa2e10025fe1ca28cecc3624073784
-
SHA1
7865ddeb997393ed9cca4c18acaea94fa2e415f8
-
SHA256
640ad0e33f4bee53283e320000970310efd642c66037b62af94d0f172c41b533
-
SHA512
87909ddcdc0540564d1be4a25aa53b8156d91a8e3951ecfae79affa9328472c3d583f3bc1aa89d49e0656a9b564756067416ffb6cb041db8cf7a3afd3601e52c
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7yX2k4dY5xNKlmuLIWwnVcHBV4BnkjP6uQsHT:/U5rCOTeiDJxwxNOIdnVmj4Bnkjl5NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3708 781E.tmp 2824 7927.tmp 3156 7A02.tmp 3184 7ACD.tmp 844 7BC7.tmp 4292 7C64.tmp 4020 80A9.tmp 4188 8146.tmp 4184 81D2.tmp 4528 828E.tmp 1880 8359.tmp 1652 8443.tmp 3712 84DF.tmp 4000 85CA.tmp 3344 8695.tmp 800 8760.tmp 392 87ED.tmp 2308 88A8.tmp 4708 8983.tmp 1108 8A1F.tmp 2160 8AEA.tmp 4584 8B77.tmp 3704 8C42.tmp 64 8D0D.tmp 964 8DA9.tmp 1824 8E94.tmp 1456 8F4F.tmp 4608 901A.tmp 1184 90E6.tmp 2576 91B1.tmp 2416 928B.tmp 2960 9376.tmp 1544 9431.tmp 3316 94AE.tmp 1628 952B.tmp 4976 9599.tmp 992 9625.tmp 2804 96A2.tmp 3124 972F.tmp 916 97CB.tmp 624 9858.tmp 3440 98D5.tmp 3972 9990.tmp 4900 9A3C.tmp 2032 9AAA.tmp 2792 9B17.tmp 4784 9B94.tmp 2316 9C5F.tmp 1036 9CCC.tmp 1288 9D59.tmp 3244 9DE6.tmp 4816 9E63.tmp 4720 9EE0.tmp 3348 9F7C.tmp 3512 9FF9.tmp 3488 A095.tmp 4188 A131.tmp 1904 A1AE.tmp 4416 A22B.tmp 4528 A2C8.tmp 1880 A364.tmp 5028 A3E1.tmp 5012 A49C.tmp 4728 A519.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4840 wrote to memory of 3708 4840 2024-02-19_9dfa2e10025fe1ca28cecc3624073784_mafia.exe 84 PID 4840 wrote to memory of 3708 4840 2024-02-19_9dfa2e10025fe1ca28cecc3624073784_mafia.exe 84 PID 4840 wrote to memory of 3708 4840 2024-02-19_9dfa2e10025fe1ca28cecc3624073784_mafia.exe 84 PID 3708 wrote to memory of 2824 3708 781E.tmp 85 PID 3708 wrote to memory of 2824 3708 781E.tmp 85 PID 3708 wrote to memory of 2824 3708 781E.tmp 85 PID 2824 wrote to memory of 3156 2824 7927.tmp 86 PID 2824 wrote to memory of 3156 2824 7927.tmp 86 PID 2824 wrote to memory of 3156 2824 7927.tmp 86 PID 3156 wrote to memory of 3184 3156 7A02.tmp 87 PID 3156 wrote to memory of 3184 3156 7A02.tmp 87 PID 3156 wrote to memory of 3184 3156 7A02.tmp 87 PID 3184 wrote to memory of 844 3184 7ACD.tmp 88 PID 3184 wrote to memory of 844 3184 7ACD.tmp 88 PID 3184 wrote to memory of 844 3184 7ACD.tmp 88 PID 844 wrote to memory of 4292 844 7BC7.tmp 89 PID 844 wrote to memory of 4292 844 7BC7.tmp 89 PID 844 wrote to memory of 4292 844 7BC7.tmp 89 PID 4292 wrote to memory of 4020 4292 7C64.tmp 90 PID 4292 wrote to memory of 4020 4292 7C64.tmp 90 PID 4292 wrote to memory of 4020 4292 7C64.tmp 90 PID 4020 wrote to memory of 4188 4020 80A9.tmp 91 PID 4020 wrote to memory of 4188 4020 80A9.tmp 91 PID 4020 wrote to memory of 4188 4020 80A9.tmp 91 PID 4188 wrote to memory of 4184 4188 8146.tmp 92 PID 4188 wrote to memory of 4184 4188 8146.tmp 92 PID 4188 wrote to memory of 4184 4188 8146.tmp 92 PID 4184 wrote to memory of 4528 4184 81D2.tmp 93 PID 4184 wrote to memory of 4528 4184 81D2.tmp 93 PID 4184 wrote to memory of 4528 4184 81D2.tmp 93 PID 4528 wrote to memory of 1880 4528 828E.tmp 94 PID 4528 wrote to memory of 1880 4528 828E.tmp 94 PID 4528 wrote to memory of 1880 4528 828E.tmp 94 PID 1880 wrote to memory of 1652 1880 8359.tmp 95 PID 1880 wrote to memory of 1652 1880 8359.tmp 95 PID 1880 wrote to memory of 1652 1880 8359.tmp 95 PID 1652 wrote to memory of 3712 1652 8443.tmp 96 PID 1652 wrote to memory of 3712 1652 8443.tmp 96 PID 1652 wrote to memory of 3712 1652 8443.tmp 96 PID 3712 wrote to memory of 4000 3712 84DF.tmp 97 PID 3712 wrote to memory of 4000 3712 84DF.tmp 97 PID 3712 wrote to memory of 4000 3712 84DF.tmp 97 PID 4000 wrote to memory of 3344 4000 85CA.tmp 98 PID 4000 wrote to memory of 3344 4000 85CA.tmp 98 PID 4000 wrote to memory of 3344 4000 85CA.tmp 98 PID 3344 wrote to memory of 800 3344 8695.tmp 99 PID 3344 wrote to memory of 800 3344 8695.tmp 99 PID 3344 wrote to memory of 800 3344 8695.tmp 99 PID 800 wrote to memory of 392 800 8760.tmp 100 PID 800 wrote to memory of 392 800 8760.tmp 100 PID 800 wrote to memory of 392 800 8760.tmp 100 PID 392 wrote to memory of 2308 392 87ED.tmp 101 PID 392 wrote to memory of 2308 392 87ED.tmp 101 PID 392 wrote to memory of 2308 392 87ED.tmp 101 PID 2308 wrote to memory of 4708 2308 88A8.tmp 102 PID 2308 wrote to memory of 4708 2308 88A8.tmp 102 PID 2308 wrote to memory of 4708 2308 88A8.tmp 102 PID 4708 wrote to memory of 1108 4708 8983.tmp 103 PID 4708 wrote to memory of 1108 4708 8983.tmp 103 PID 4708 wrote to memory of 1108 4708 8983.tmp 103 PID 1108 wrote to memory of 2160 1108 8A1F.tmp 104 PID 1108 wrote to memory of 2160 1108 8A1F.tmp 104 PID 1108 wrote to memory of 2160 1108 8A1F.tmp 104 PID 2160 wrote to memory of 4584 2160 8AEA.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_9dfa2e10025fe1ca28cecc3624073784_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_9dfa2e10025fe1ca28cecc3624073784_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"23⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"24⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"25⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"26⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"27⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"28⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"29⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"30⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"31⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"32⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"33⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"34⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"35⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"36⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"37⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"38⤵
- Executes dropped EXE
PID:992 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"39⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"40⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"41⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"42⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"43⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"44⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"45⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"46⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"47⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"48⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"49⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"50⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"51⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"52⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"53⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"54⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"55⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"56⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"57⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"58⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"59⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"60⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"61⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"62⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"63⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"64⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"65⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"66⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"67⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"68⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"69⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"70⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"71⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"72⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"73⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"74⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"75⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"76⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"77⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"78⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"79⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"80⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"81⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"82⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"83⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"84⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"85⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"86⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"87⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"88⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"89⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"90⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"91⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"92⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"93⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"94⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"95⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"96⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"97⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"98⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"99⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"100⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"101⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"102⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"103⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"104⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"105⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"106⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"107⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"108⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"109⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"110⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"111⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"112⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"113⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"114⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"115⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"116⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"117⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"118⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"119⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"120⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"121⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"122⤵PID:1212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-