Analysis
-
max time kernel
150s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 14:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-05_7d9d61b7fd326fd3f38df8263338af88_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-05_7d9d61b7fd326fd3f38df8263338af88_mafia.exe
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
2024-07-05_7d9d61b7fd326fd3f38df8263338af88_mafia.exe
-
Size
520KB
-
MD5
7d9d61b7fd326fd3f38df8263338af88
-
SHA1
1d11cc811fd47db5bd3dcf4bc1dc42f346749a3b
-
SHA256
ecda8f794fefe9ea619d6797f1ca79f41e20f8cdf15adaf43ea111b73ad1e0dc
-
SHA512
b43ca96aba44878064467e96a7abda429c3dc28f44808ba6c69a28f7c746800d8addb60f41728bbf55858b4d8aa69e48ffa856e999cbbb0b25fd7ee0192057f0
-
SSDEEP
12288:roRXOQjmOySCSmL73FIW7ksIpbKeJoEDOZZOsfZGBU82GNZ:rogQ9ySnBW7ksI4/EDO+x/N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5032 B565.tmp 3524 B611.tmp 1856 B69E.tmp 964 B769.tmp 4880 B7D6.tmp 1660 B873.tmp 5052 B91E.tmp 4620 B99B.tmp 4064 BA47.tmp 2844 BAD4.tmp 2264 BB51.tmp 1416 BBCE.tmp 1800 BC2C.tmp 1280 BCC8.tmp 2036 BD26.tmp 100 BDE1.tmp 1796 BE3F.tmp 1968 BE9D.tmp 4884 BEFA.tmp 3900 BF58.tmp 4652 BFC6.tmp 1016 C052.tmp 1420 C0FE.tmp 1592 C19A.tmp 2236 C227.tmp 1828 C2C3.tmp 1064 C340.tmp 2948 C3BD.tmp 512 C42B.tmp 1900 C4C7.tmp 1616 C544.tmp 2976 C5C1.tmp 4192 C66D.tmp 2380 C6CA.tmp 760 C738.tmp 880 C796.tmp 5056 C803.tmp 4672 C861.tmp 3128 C8CE.tmp 1912 C92C.tmp 1600 C98A.tmp 4420 C9E7.tmp 1604 CA45.tmp 4092 CAA3.tmp 3448 CB01.tmp 2776 CB5E.tmp 4604 CBCC.tmp 2468 CC39.tmp 3228 CC97.tmp 744 CD04.tmp 4360 CD62.tmp 3188 CDC0.tmp 3020 CE2D.tmp 640 CE8B.tmp 840 CEF8.tmp 3108 CF56.tmp 1076 CFB4.tmp 1244 D021.tmp 232 D08E.tmp 4644 D0EC.tmp 684 D14A.tmp 912 D1A8.tmp 4744 D215.tmp 5044 D273.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2044 wrote to memory of 5032 2044 2024-07-05_7d9d61b7fd326fd3f38df8263338af88_mafia.exe 83 PID 2044 wrote to memory of 5032 2044 2024-07-05_7d9d61b7fd326fd3f38df8263338af88_mafia.exe 83 PID 2044 wrote to memory of 5032 2044 2024-07-05_7d9d61b7fd326fd3f38df8263338af88_mafia.exe 83 PID 5032 wrote to memory of 3524 5032 B565.tmp 85 PID 5032 wrote to memory of 3524 5032 B565.tmp 85 PID 5032 wrote to memory of 3524 5032 B565.tmp 85 PID 3524 wrote to memory of 1856 3524 B611.tmp 86 PID 3524 wrote to memory of 1856 3524 B611.tmp 86 PID 3524 wrote to memory of 1856 3524 B611.tmp 86 PID 1856 wrote to memory of 964 1856 B69E.tmp 87 PID 1856 wrote to memory of 964 1856 B69E.tmp 87 PID 1856 wrote to memory of 964 1856 B69E.tmp 87 PID 964 wrote to memory of 4880 964 B769.tmp 88 PID 964 wrote to memory of 4880 964 B769.tmp 88 PID 964 wrote to memory of 4880 964 B769.tmp 88 PID 4880 wrote to memory of 1660 4880 B7D6.tmp 89 PID 4880 wrote to memory of 1660 4880 B7D6.tmp 89 PID 4880 wrote to memory of 1660 4880 B7D6.tmp 89 PID 1660 wrote to memory of 5052 1660 B873.tmp 90 PID 1660 wrote to memory of 5052 1660 B873.tmp 90 PID 1660 wrote to memory of 5052 1660 B873.tmp 90 PID 5052 wrote to memory of 4620 5052 B91E.tmp 91 PID 5052 wrote to memory of 4620 5052 B91E.tmp 91 PID 5052 wrote to memory of 4620 5052 B91E.tmp 91 PID 4620 wrote to memory of 4064 4620 B99B.tmp 92 PID 4620 wrote to memory of 4064 4620 B99B.tmp 92 PID 4620 wrote to memory of 4064 4620 B99B.tmp 92 PID 4064 wrote to memory of 2844 4064 BA47.tmp 93 PID 4064 wrote to memory of 2844 4064 BA47.tmp 93 PID 4064 wrote to memory of 2844 4064 BA47.tmp 93 PID 2844 wrote to memory of 2264 2844 BAD4.tmp 94 PID 2844 wrote to memory of 2264 2844 BAD4.tmp 94 PID 2844 wrote to memory of 2264 2844 BAD4.tmp 94 PID 2264 wrote to memory of 1416 2264 BB51.tmp 95 PID 2264 wrote to memory of 1416 2264 BB51.tmp 95 PID 2264 wrote to memory of 1416 2264 BB51.tmp 95 PID 1416 wrote to memory of 1800 1416 BBCE.tmp 96 PID 1416 wrote to memory of 1800 1416 BBCE.tmp 96 PID 1416 wrote to memory of 1800 1416 BBCE.tmp 96 PID 1800 wrote to memory of 1280 1800 BC2C.tmp 97 PID 1800 wrote to memory of 1280 1800 BC2C.tmp 97 PID 1800 wrote to memory of 1280 1800 BC2C.tmp 97 PID 1280 wrote to memory of 2036 1280 BCC8.tmp 98 PID 1280 wrote to memory of 2036 1280 BCC8.tmp 98 PID 1280 wrote to memory of 2036 1280 BCC8.tmp 98 PID 2036 wrote to memory of 100 2036 BD26.tmp 99 PID 2036 wrote to memory of 100 2036 BD26.tmp 99 PID 2036 wrote to memory of 100 2036 BD26.tmp 99 PID 100 wrote to memory of 1796 100 BDE1.tmp 100 PID 100 wrote to memory of 1796 100 BDE1.tmp 100 PID 100 wrote to memory of 1796 100 BDE1.tmp 100 PID 1796 wrote to memory of 1968 1796 BE3F.tmp 101 PID 1796 wrote to memory of 1968 1796 BE3F.tmp 101 PID 1796 wrote to memory of 1968 1796 BE3F.tmp 101 PID 1968 wrote to memory of 4884 1968 BE9D.tmp 102 PID 1968 wrote to memory of 4884 1968 BE9D.tmp 102 PID 1968 wrote to memory of 4884 1968 BE9D.tmp 102 PID 4884 wrote to memory of 3900 4884 BEFA.tmp 103 PID 4884 wrote to memory of 3900 4884 BEFA.tmp 103 PID 4884 wrote to memory of 3900 4884 BEFA.tmp 103 PID 3900 wrote to memory of 4652 3900 BF58.tmp 104 PID 3900 wrote to memory of 4652 3900 BF58.tmp 104 PID 3900 wrote to memory of 4652 3900 BF58.tmp 104 PID 4652 wrote to memory of 1016 4652 BFC6.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-05_7d9d61b7fd326fd3f38df8263338af88_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-05_7d9d61b7fd326fd3f38df8263338af88_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"23⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"24⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"25⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"26⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"27⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"28⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"29⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"30⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"31⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"32⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"33⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"34⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"35⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"36⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"37⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"38⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"39⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"40⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"41⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"42⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"43⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"44⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"45⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"46⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"47⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"48⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\CC39.tmp"C:\Users\Admin\AppData\Local\Temp\CC39.tmp"49⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"50⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\CD04.tmp"C:\Users\Admin\AppData\Local\Temp\CD04.tmp"51⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"52⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"53⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"54⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"55⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"56⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"57⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"58⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"59⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\D08E.tmp"C:\Users\Admin\AppData\Local\Temp\D08E.tmp"60⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"61⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"62⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"63⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"64⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\D273.tmp"C:\Users\Admin\AppData\Local\Temp\D273.tmp"65⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"66⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"67⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"68⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\D428.tmp"C:\Users\Admin\AppData\Local\Temp\D428.tmp"69⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\D496.tmp"C:\Users\Admin\AppData\Local\Temp\D496.tmp"70⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"71⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"72⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\D590.tmp"C:\Users\Admin\AppData\Local\Temp\D590.tmp"73⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"74⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\D64B.tmp"C:\Users\Admin\AppData\Local\Temp\D64B.tmp"75⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"76⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\D716.tmp"C:\Users\Admin\AppData\Local\Temp\D716.tmp"77⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\D784.tmp"C:\Users\Admin\AppData\Local\Temp\D784.tmp"78⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"79⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\D830.tmp"C:\Users\Admin\AppData\Local\Temp\D830.tmp"80⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\D88D.tmp"C:\Users\Admin\AppData\Local\Temp\D88D.tmp"81⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"82⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\D987.tmp"C:\Users\Admin\AppData\Local\Temp\D987.tmp"83⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"84⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\DA43.tmp"C:\Users\Admin\AppData\Local\Temp\DA43.tmp"85⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"86⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"87⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"88⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"89⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\DC27.tmp"C:\Users\Admin\AppData\Local\Temp\DC27.tmp"90⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\DC85.tmp"C:\Users\Admin\AppData\Local\Temp\DC85.tmp"91⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"92⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\DD40.tmp"C:\Users\Admin\AppData\Local\Temp\DD40.tmp"93⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"94⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"95⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"96⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"97⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\DF06.tmp"C:\Users\Admin\AppData\Local\Temp\DF06.tmp"98⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\DF63.tmp"C:\Users\Admin\AppData\Local\Temp\DF63.tmp"99⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"100⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"101⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"102⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"103⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\E157.tmp"C:\Users\Admin\AppData\Local\Temp\E157.tmp"104⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"105⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\E213.tmp"C:\Users\Admin\AppData\Local\Temp\E213.tmp"106⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"107⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"108⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\E32C.tmp"C:\Users\Admin\AppData\Local\Temp\E32C.tmp"109⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"110⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"111⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\E436.tmp"C:\Users\Admin\AppData\Local\Temp\E436.tmp"112⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"113⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"114⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"115⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"116⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"117⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"118⤵PID:180
-
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"119⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"120⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\E781.tmp"C:\Users\Admin\AppData\Local\Temp\E781.tmp"121⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"122⤵PID:4372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-