Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 16:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-15_a523e81e160b890f38f073c2f663457d_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-15_a523e81e160b890f38f073c2f663457d_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-15_a523e81e160b890f38f073c2f663457d_mafia.exe
-
Size
536KB
-
MD5
a523e81e160b890f38f073c2f663457d
-
SHA1
d45f79bf5f9cd984b4a1e3a5e718e72fea3c6eff
-
SHA256
375f80b77ed98e855d7bb8a47c561a0dcc08e31c8262ed701ae3507fcc8eddab
-
SHA512
9e5210898a72aacf5eb3cd6e3fe0aa4b8e8a4e0a58c8ff1fd43f602dbab57b0e3f95c86a5296d5608ef13fed6fbe51eda65980655a0d9d00d26edbaa34f93824
-
SSDEEP
6144:Zorf3lPvovsgZnqG2C7mOTeiL4DP1amUydtoSTH0LhFC26KOaOeiCwzk+EXT2SFC:wU5rCOTeiUUU6+oO9kBT/kIZxVJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2168 8983.tmp 4952 8A8D.tmp 3332 8B87.tmp 3408 8C23.tmp 1668 8D4C.tmp 1420 8DF8.tmp 1404 8EE2.tmp 4896 8F7E.tmp 4380 9078.tmp 1504 9172.tmp 5056 922E.tmp 5000 92CA.tmp 1788 9376.tmp 4760 9460.tmp 2552 94ED.tmp 3696 9599.tmp 1056 9625.tmp 1708 96E1.tmp 1968 975E.tmp 2216 9819.tmp 4564 98C5.tmp 880 9952.tmp 2008 99DE.tmp 4804 9A7B.tmp 3884 9B55.tmp 816 9BF2.tmp 3104 9D1B.tmp 2396 9DA7.tmp 2800 9E34.tmp 1032 9EE0.tmp 2488 9F5D.tmp 396 A047.tmp 4432 A0D4.tmp 4480 A170.tmp 2588 A1DD.tmp 3548 A25A.tmp 5016 A2D7.tmp 2168 A345.tmp 4528 A3A2.tmp 232 A400.tmp 1836 A49C.tmp 4008 A529.tmp 2984 A5B6.tmp 2020 A623.tmp 3504 A690.tmp 2252 A72D.tmp 4980 A7B9.tmp 60 A827.tmp 4896 A875.tmp 2152 A8C3.tmp 1492 A921.tmp 4700 A97E.tmp 4296 A9CD.tmp 4616 AA1B.tmp 2544 AA69.tmp 3916 AAB7.tmp 4180 AB15.tmp 1376 AB63.tmp 5100 ABB1.tmp 4324 ABFF.tmp 3000 AC4D.tmp 1380 AC9B.tmp 4948 ACF9.tmp 1904 AD57.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1328 wrote to memory of 2168 1328 2024-05-15_a523e81e160b890f38f073c2f663457d_mafia.exe 82 PID 1328 wrote to memory of 2168 1328 2024-05-15_a523e81e160b890f38f073c2f663457d_mafia.exe 82 PID 1328 wrote to memory of 2168 1328 2024-05-15_a523e81e160b890f38f073c2f663457d_mafia.exe 82 PID 2168 wrote to memory of 4952 2168 8983.tmp 84 PID 2168 wrote to memory of 4952 2168 8983.tmp 84 PID 2168 wrote to memory of 4952 2168 8983.tmp 84 PID 4952 wrote to memory of 3332 4952 8A8D.tmp 87 PID 4952 wrote to memory of 3332 4952 8A8D.tmp 87 PID 4952 wrote to memory of 3332 4952 8A8D.tmp 87 PID 3332 wrote to memory of 3408 3332 8B87.tmp 88 PID 3332 wrote to memory of 3408 3332 8B87.tmp 88 PID 3332 wrote to memory of 3408 3332 8B87.tmp 88 PID 3408 wrote to memory of 1668 3408 8C23.tmp 89 PID 3408 wrote to memory of 1668 3408 8C23.tmp 89 PID 3408 wrote to memory of 1668 3408 8C23.tmp 89 PID 1668 wrote to memory of 1420 1668 8D4C.tmp 90 PID 1668 wrote to memory of 1420 1668 8D4C.tmp 90 PID 1668 wrote to memory of 1420 1668 8D4C.tmp 90 PID 1420 wrote to memory of 1404 1420 8DF8.tmp 91 PID 1420 wrote to memory of 1404 1420 8DF8.tmp 91 PID 1420 wrote to memory of 1404 1420 8DF8.tmp 91 PID 1404 wrote to memory of 4896 1404 8EE2.tmp 92 PID 1404 wrote to memory of 4896 1404 8EE2.tmp 92 PID 1404 wrote to memory of 4896 1404 8EE2.tmp 92 PID 4896 wrote to memory of 4380 4896 8F7E.tmp 93 PID 4896 wrote to memory of 4380 4896 8F7E.tmp 93 PID 4896 wrote to memory of 4380 4896 8F7E.tmp 93 PID 4380 wrote to memory of 1504 4380 9078.tmp 94 PID 4380 wrote to memory of 1504 4380 9078.tmp 94 PID 4380 wrote to memory of 1504 4380 9078.tmp 94 PID 1504 wrote to memory of 5056 1504 9172.tmp 95 PID 1504 wrote to memory of 5056 1504 9172.tmp 95 PID 1504 wrote to memory of 5056 1504 9172.tmp 95 PID 5056 wrote to memory of 5000 5056 922E.tmp 96 PID 5056 wrote to memory of 5000 5056 922E.tmp 96 PID 5056 wrote to memory of 5000 5056 922E.tmp 96 PID 5000 wrote to memory of 1788 5000 92CA.tmp 97 PID 5000 wrote to memory of 1788 5000 92CA.tmp 97 PID 5000 wrote to memory of 1788 5000 92CA.tmp 97 PID 1788 wrote to memory of 4760 1788 9376.tmp 99 PID 1788 wrote to memory of 4760 1788 9376.tmp 99 PID 1788 wrote to memory of 4760 1788 9376.tmp 99 PID 4760 wrote to memory of 2552 4760 9460.tmp 100 PID 4760 wrote to memory of 2552 4760 9460.tmp 100 PID 4760 wrote to memory of 2552 4760 9460.tmp 100 PID 2552 wrote to memory of 3696 2552 94ED.tmp 101 PID 2552 wrote to memory of 3696 2552 94ED.tmp 101 PID 2552 wrote to memory of 3696 2552 94ED.tmp 101 PID 3696 wrote to memory of 1056 3696 9599.tmp 102 PID 3696 wrote to memory of 1056 3696 9599.tmp 102 PID 3696 wrote to memory of 1056 3696 9599.tmp 102 PID 1056 wrote to memory of 1708 1056 9625.tmp 103 PID 1056 wrote to memory of 1708 1056 9625.tmp 103 PID 1056 wrote to memory of 1708 1056 9625.tmp 103 PID 1708 wrote to memory of 1968 1708 96E1.tmp 105 PID 1708 wrote to memory of 1968 1708 96E1.tmp 105 PID 1708 wrote to memory of 1968 1708 96E1.tmp 105 PID 1968 wrote to memory of 2216 1968 975E.tmp 106 PID 1968 wrote to memory of 2216 1968 975E.tmp 106 PID 1968 wrote to memory of 2216 1968 975E.tmp 106 PID 2216 wrote to memory of 4564 2216 9819.tmp 107 PID 2216 wrote to memory of 4564 2216 9819.tmp 107 PID 2216 wrote to memory of 4564 2216 9819.tmp 107 PID 4564 wrote to memory of 880 4564 98C5.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-15_a523e81e160b890f38f073c2f663457d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-15_a523e81e160b890f38f073c2f663457d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"23⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"24⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"25⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"26⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"27⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"28⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"29⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"30⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"31⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"32⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"33⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"34⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"35⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"36⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"37⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"38⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"39⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"40⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"41⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"42⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"43⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"44⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"45⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"46⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"47⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"48⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"49⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"50⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"51⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"52⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"53⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"54⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"55⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"56⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"57⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"58⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"59⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"60⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"61⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"62⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"63⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"64⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"65⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"66⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"67⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"68⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"69⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"70⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"71⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"72⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"73⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"74⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"75⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"76⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"77⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"78⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"79⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"80⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"81⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"82⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"83⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"84⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"85⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"86⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"87⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"88⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"89⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"90⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"91⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"92⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"93⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"94⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"95⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"96⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"97⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"98⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"99⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"100⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"101⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"102⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"103⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"104⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"105⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"106⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"107⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"108⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"109⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"110⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"111⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"112⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"113⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"114⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"115⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"116⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"117⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"118⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"119⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"120⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"121⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"122⤵PID:4068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-