Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
09-07-2024 16:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe
-
Size
488KB
-
MD5
5b7ad6e729773f8363bd5a961533a1df
-
SHA1
86547c246eccf1bad57316787d0b6e58da0fc9df
-
SHA256
9887b305a5795cc69ec6425da23264374d3dc1547b0fa7fb66e1d5b26fa59d4d
-
SHA512
afdd10b003fc2e3ad26b7c79e30fb623214ce7142b96e63ad0df7e8362851b59e6953e31aec357fadf1ac04d5dc241b50905a21acd6e6329f1481eee0357b817
-
SSDEEP
12288:/U5rCOTeiD+MgTh/INpT1AhozlIHwQyOk5ZENZ:/UQOJD+MCiT8oJIX65ZEN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4112 8A1F.tmp 1688 8ADB.tmp 668 8B87.tmp 3308 8C32.tmp 1932 8CA0.tmp 1172 8D4C.tmp 908 8DE8.tmp 1272 8E84.tmp 1404 8F01.tmp 1008 8F9D.tmp 3708 9049.tmp 3948 90C6.tmp 736 9163.tmp 3744 91FF.tmp 632 929B.tmp 448 9337.tmp 1060 93A5.tmp 3976 9451.tmp 2436 94FC.tmp 4008 956A.tmp 2060 95D7.tmp 1420 9673.tmp 2020 9710.tmp 3000 977D.tmp 2708 980A.tmp 220 9877.tmp 956 98E4.tmp 2588 9990.tmp 1184 9A0D.tmp 2520 9A7B.tmp 3212 9B07.tmp 32 9BA4.tmp 2268 9C40.tmp 3928 9CAD.tmp 4484 9D0B.tmp 5052 9D69.tmp 4816 9DC6.tmp 4796 9E24.tmp 4336 9E92.tmp 3964 9EFF.tmp 3096 9F6C.tmp 2596 9FBA.tmp 2152 A009.tmp 5112 A057.tmp 2348 A0A5.tmp 3416 A103.tmp 3900 A151.tmp 5036 A1AE.tmp 4304 A20C.tmp 3048 A27A.tmp 4308 A2E7.tmp 3676 A345.tmp 1256 A3A2.tmp 3716 A400.tmp 3620 A45E.tmp 1356 A4BC.tmp 1432 A50A.tmp 4012 A558.tmp 3492 A5A6.tmp 1552 A604.tmp 824 A662.tmp 620 A6B0.tmp 4848 A70D.tmp 4376 A77B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5080 wrote to memory of 4112 5080 2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe 79 PID 5080 wrote to memory of 4112 5080 2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe 79 PID 5080 wrote to memory of 4112 5080 2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe 79 PID 4112 wrote to memory of 1688 4112 8A1F.tmp 80 PID 4112 wrote to memory of 1688 4112 8A1F.tmp 80 PID 4112 wrote to memory of 1688 4112 8A1F.tmp 80 PID 1688 wrote to memory of 668 1688 8ADB.tmp 81 PID 1688 wrote to memory of 668 1688 8ADB.tmp 81 PID 1688 wrote to memory of 668 1688 8ADB.tmp 81 PID 668 wrote to memory of 3308 668 8B87.tmp 82 PID 668 wrote to memory of 3308 668 8B87.tmp 82 PID 668 wrote to memory of 3308 668 8B87.tmp 82 PID 3308 wrote to memory of 1932 3308 8C32.tmp 83 PID 3308 wrote to memory of 1932 3308 8C32.tmp 83 PID 3308 wrote to memory of 1932 3308 8C32.tmp 83 PID 1932 wrote to memory of 1172 1932 8CA0.tmp 84 PID 1932 wrote to memory of 1172 1932 8CA0.tmp 84 PID 1932 wrote to memory of 1172 1932 8CA0.tmp 84 PID 1172 wrote to memory of 908 1172 8D4C.tmp 85 PID 1172 wrote to memory of 908 1172 8D4C.tmp 85 PID 1172 wrote to memory of 908 1172 8D4C.tmp 85 PID 908 wrote to memory of 1272 908 8DE8.tmp 86 PID 908 wrote to memory of 1272 908 8DE8.tmp 86 PID 908 wrote to memory of 1272 908 8DE8.tmp 86 PID 1272 wrote to memory of 1404 1272 8E84.tmp 87 PID 1272 wrote to memory of 1404 1272 8E84.tmp 87 PID 1272 wrote to memory of 1404 1272 8E84.tmp 87 PID 1404 wrote to memory of 1008 1404 8F01.tmp 88 PID 1404 wrote to memory of 1008 1404 8F01.tmp 88 PID 1404 wrote to memory of 1008 1404 8F01.tmp 88 PID 1008 wrote to memory of 3708 1008 8F9D.tmp 89 PID 1008 wrote to memory of 3708 1008 8F9D.tmp 89 PID 1008 wrote to memory of 3708 1008 8F9D.tmp 89 PID 3708 wrote to memory of 3948 3708 9049.tmp 90 PID 3708 wrote to memory of 3948 3708 9049.tmp 90 PID 3708 wrote to memory of 3948 3708 9049.tmp 90 PID 3948 wrote to memory of 736 3948 90C6.tmp 91 PID 3948 wrote to memory of 736 3948 90C6.tmp 91 PID 3948 wrote to memory of 736 3948 90C6.tmp 91 PID 736 wrote to memory of 3744 736 9163.tmp 92 PID 736 wrote to memory of 3744 736 9163.tmp 92 PID 736 wrote to memory of 3744 736 9163.tmp 92 PID 3744 wrote to memory of 632 3744 91FF.tmp 93 PID 3744 wrote to memory of 632 3744 91FF.tmp 93 PID 3744 wrote to memory of 632 3744 91FF.tmp 93 PID 632 wrote to memory of 448 632 929B.tmp 94 PID 632 wrote to memory of 448 632 929B.tmp 94 PID 632 wrote to memory of 448 632 929B.tmp 94 PID 448 wrote to memory of 1060 448 9337.tmp 95 PID 448 wrote to memory of 1060 448 9337.tmp 95 PID 448 wrote to memory of 1060 448 9337.tmp 95 PID 1060 wrote to memory of 3976 1060 93A5.tmp 96 PID 1060 wrote to memory of 3976 1060 93A5.tmp 96 PID 1060 wrote to memory of 3976 1060 93A5.tmp 96 PID 3976 wrote to memory of 2436 3976 9451.tmp 97 PID 3976 wrote to memory of 2436 3976 9451.tmp 97 PID 3976 wrote to memory of 2436 3976 9451.tmp 97 PID 2436 wrote to memory of 4008 2436 94FC.tmp 98 PID 2436 wrote to memory of 4008 2436 94FC.tmp 98 PID 2436 wrote to memory of 4008 2436 94FC.tmp 98 PID 4008 wrote to memory of 2060 4008 956A.tmp 99 PID 4008 wrote to memory of 2060 4008 956A.tmp 99 PID 4008 wrote to memory of 2060 4008 956A.tmp 99 PID 2060 wrote to memory of 1420 2060 95D7.tmp 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-09_5b7ad6e729773f8363bd5a961533a1df_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"23⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"24⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"25⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"26⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"27⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"28⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"29⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"30⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"31⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"32⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"33⤵
- Executes dropped EXE
PID:32 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"34⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"35⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"36⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"37⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"38⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"39⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"40⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"41⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"42⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"43⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"44⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"45⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"46⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"47⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"48⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"49⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"50⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"51⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"52⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"53⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"54⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"55⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"56⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"57⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"58⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"59⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"60⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"61⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"62⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"63⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"64⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"65⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"66⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"67⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"68⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"69⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"70⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"71⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"72⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"73⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"74⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"75⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"76⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"77⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"78⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"79⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"80⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"81⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"82⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"83⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"84⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"85⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"86⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"87⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"88⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"89⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"90⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"91⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"92⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"93⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"94⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"95⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"96⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"97⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"98⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"99⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"100⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"101⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"102⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"103⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"104⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"105⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"106⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"107⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"108⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"109⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"110⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"111⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"112⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"113⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"114⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"115⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"116⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"117⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"118⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"119⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"120⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"121⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"122⤵PID:1188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-