Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 00:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-10_d1d153f637e9ee5e8e6dd7d3bb3de579_mafia.exe
Resource
win7-20240705-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-10_d1d153f637e9ee5e8e6dd7d3bb3de579_mafia.exe
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
2024-07-10_d1d153f637e9ee5e8e6dd7d3bb3de579_mafia.exe
-
Size
520KB
-
MD5
d1d153f637e9ee5e8e6dd7d3bb3de579
-
SHA1
2df82772bd46d45ee40f425aada8e1993b4c7b27
-
SHA256
cc870ee78073c0b3c73160c8eaf7f6b13e691b687d4bd81702d73055ca091313
-
SHA512
44fb65310786a3f6abb46f14d3895e0c8a7ae459667220d9384dc31b36135f0754e10ce348cf3a0a7563620d59250d5a71b0b2f9ef38923190d96e725219460d
-
SSDEEP
12288:gj8fuxR21t5i8f/xQEo6yziMUcgyqnDNZ:gj8fuK1GYpQETbhDN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2676 B248.tmp 4372 B2E5.tmp 3276 B3A0.tmp 4632 B41D.tmp 3168 B49A.tmp 4068 B508.tmp 4240 B5B3.tmp 5016 B650.tmp 4760 B6DC.tmp 3268 B759.tmp 3052 B7E6.tmp 5084 B863.tmp 1468 B8C1.tmp 3204 B94D.tmp 3448 B9BB.tmp 4680 BA57.tmp 3224 BB03.tmp 3024 BB61.tmp 4416 BBED.tmp 3892 BC6A.tmp 2508 BCC8.tmp 1304 BD45.tmp 4752 BDE1.tmp 3536 BE3F.tmp 1552 BE9D.tmp 3428 BF29.tmp 1100 BFA6.tmp 1180 C033.tmp 5104 C0CF.tmp 2412 C12D.tmp 2544 C19A.tmp 1540 C217.tmp 4080 C275.tmp 4028 C2F2.tmp 3256 C340.tmp 2424 C3AE.tmp 3944 C40B.tmp 3508 C459.tmp 3740 C4B7.tmp 3012 C515.tmp 3628 C563.tmp 4052 C5B1.tmp 464 C5FF.tmp 1956 C64D.tmp 2896 C6AB.tmp 232 C6F9.tmp 4128 C757.tmp 4520 C7B5.tmp 4700 C803.tmp 4420 C851.tmp 4544 C8BE.tmp 4704 C92C.tmp 2872 C999.tmp 1948 C9E7.tmp 1908 CA35.tmp 4568 CA93.tmp 1600 CAE1.tmp 1088 CB3F.tmp 3880 CB9D.tmp 224 CC0A.tmp 4020 CC68.tmp 4068 CCB6.tmp 2696 CD23.tmp 2080 CD81.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2816 wrote to memory of 2676 2816 2024-07-10_d1d153f637e9ee5e8e6dd7d3bb3de579_mafia.exe 83 PID 2816 wrote to memory of 2676 2816 2024-07-10_d1d153f637e9ee5e8e6dd7d3bb3de579_mafia.exe 83 PID 2816 wrote to memory of 2676 2816 2024-07-10_d1d153f637e9ee5e8e6dd7d3bb3de579_mafia.exe 83 PID 2676 wrote to memory of 4372 2676 B248.tmp 85 PID 2676 wrote to memory of 4372 2676 B248.tmp 85 PID 2676 wrote to memory of 4372 2676 B248.tmp 85 PID 4372 wrote to memory of 3276 4372 B2E5.tmp 86 PID 4372 wrote to memory of 3276 4372 B2E5.tmp 86 PID 4372 wrote to memory of 3276 4372 B2E5.tmp 86 PID 3276 wrote to memory of 4632 3276 B3A0.tmp 87 PID 3276 wrote to memory of 4632 3276 B3A0.tmp 87 PID 3276 wrote to memory of 4632 3276 B3A0.tmp 87 PID 4632 wrote to memory of 3168 4632 B41D.tmp 88 PID 4632 wrote to memory of 3168 4632 B41D.tmp 88 PID 4632 wrote to memory of 3168 4632 B41D.tmp 88 PID 3168 wrote to memory of 4068 3168 B49A.tmp 89 PID 3168 wrote to memory of 4068 3168 B49A.tmp 89 PID 3168 wrote to memory of 4068 3168 B49A.tmp 89 PID 4068 wrote to memory of 4240 4068 B508.tmp 90 PID 4068 wrote to memory of 4240 4068 B508.tmp 90 PID 4068 wrote to memory of 4240 4068 B508.tmp 90 PID 4240 wrote to memory of 5016 4240 B5B3.tmp 91 PID 4240 wrote to memory of 5016 4240 B5B3.tmp 91 PID 4240 wrote to memory of 5016 4240 B5B3.tmp 91 PID 5016 wrote to memory of 4760 5016 B650.tmp 92 PID 5016 wrote to memory of 4760 5016 B650.tmp 92 PID 5016 wrote to memory of 4760 5016 B650.tmp 92 PID 4760 wrote to memory of 3268 4760 B6DC.tmp 93 PID 4760 wrote to memory of 3268 4760 B6DC.tmp 93 PID 4760 wrote to memory of 3268 4760 B6DC.tmp 93 PID 3268 wrote to memory of 3052 3268 B759.tmp 94 PID 3268 wrote to memory of 3052 3268 B759.tmp 94 PID 3268 wrote to memory of 3052 3268 B759.tmp 94 PID 3052 wrote to memory of 5084 3052 B7E6.tmp 95 PID 3052 wrote to memory of 5084 3052 B7E6.tmp 95 PID 3052 wrote to memory of 5084 3052 B7E6.tmp 95 PID 5084 wrote to memory of 1468 5084 B863.tmp 96 PID 5084 wrote to memory of 1468 5084 B863.tmp 96 PID 5084 wrote to memory of 1468 5084 B863.tmp 96 PID 1468 wrote to memory of 3204 1468 B8C1.tmp 97 PID 1468 wrote to memory of 3204 1468 B8C1.tmp 97 PID 1468 wrote to memory of 3204 1468 B8C1.tmp 97 PID 3204 wrote to memory of 3448 3204 B94D.tmp 98 PID 3204 wrote to memory of 3448 3204 B94D.tmp 98 PID 3204 wrote to memory of 3448 3204 B94D.tmp 98 PID 3448 wrote to memory of 4680 3448 B9BB.tmp 99 PID 3448 wrote to memory of 4680 3448 B9BB.tmp 99 PID 3448 wrote to memory of 4680 3448 B9BB.tmp 99 PID 4680 wrote to memory of 3224 4680 BA57.tmp 100 PID 4680 wrote to memory of 3224 4680 BA57.tmp 100 PID 4680 wrote to memory of 3224 4680 BA57.tmp 100 PID 3224 wrote to memory of 3024 3224 BB03.tmp 101 PID 3224 wrote to memory of 3024 3224 BB03.tmp 101 PID 3224 wrote to memory of 3024 3224 BB03.tmp 101 PID 3024 wrote to memory of 4416 3024 BB61.tmp 102 PID 3024 wrote to memory of 4416 3024 BB61.tmp 102 PID 3024 wrote to memory of 4416 3024 BB61.tmp 102 PID 4416 wrote to memory of 3892 4416 BBED.tmp 103 PID 4416 wrote to memory of 3892 4416 BBED.tmp 103 PID 4416 wrote to memory of 3892 4416 BBED.tmp 103 PID 3892 wrote to memory of 2508 3892 BC6A.tmp 104 PID 3892 wrote to memory of 2508 3892 BC6A.tmp 104 PID 3892 wrote to memory of 2508 3892 BC6A.tmp 104 PID 2508 wrote to memory of 1304 2508 BCC8.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_d1d153f637e9ee5e8e6dd7d3bb3de579_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_d1d153f637e9ee5e8e6dd7d3bb3de579_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"23⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"24⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"25⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"26⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"27⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"28⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"29⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"30⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"31⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"32⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"33⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"34⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"35⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"36⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"37⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"38⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"39⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"40⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"41⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"42⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"43⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"44⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"45⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"46⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"47⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"48⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"49⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"50⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"51⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"52⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"53⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"54⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"55⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\CA35.tmp"C:\Users\Admin\AppData\Local\Temp\CA35.tmp"56⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"57⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"58⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"59⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"60⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"61⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\CC68.tmp"C:\Users\Admin\AppData\Local\Temp\CC68.tmp"62⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"63⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\CD23.tmp"C:\Users\Admin\AppData\Local\Temp\CD23.tmp"64⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"65⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"66⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"67⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"68⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"69⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"70⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"71⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"72⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\D07F.tmp"C:\Users\Admin\AppData\Local\Temp\D07F.tmp"73⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"74⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\D15A.tmp"C:\Users\Admin\AppData\Local\Temp\D15A.tmp"75⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"76⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"77⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"78⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"79⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\D35D.tmp"C:\Users\Admin\AppData\Local\Temp\D35D.tmp"80⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"81⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"82⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\D467.tmp"C:\Users\Admin\AppData\Local\Temp\D467.tmp"83⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"84⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"85⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\D580.tmp"C:\Users\Admin\AppData\Local\Temp\D580.tmp"86⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"87⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"88⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"89⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"90⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\D736.tmp"C:\Users\Admin\AppData\Local\Temp\D736.tmp"91⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\D784.tmp"C:\Users\Admin\AppData\Local\Temp\D784.tmp"92⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"93⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\D83F.tmp"C:\Users\Admin\AppData\Local\Temp\D83F.tmp"94⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"95⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"96⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"97⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"98⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\DA24.tmp"C:\Users\Admin\AppData\Local\Temp\DA24.tmp"99⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\DA81.tmp"C:\Users\Admin\AppData\Local\Temp\DA81.tmp"100⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"101⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"102⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"103⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"104⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\DC46.tmp"C:\Users\Admin\AppData\Local\Temp\DC46.tmp"105⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"106⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"107⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\DD50.tmp"C:\Users\Admin\AppData\Local\Temp\DD50.tmp"108⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"109⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"110⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"111⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"112⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\DF06.tmp"C:\Users\Admin\AppData\Local\Temp\DF06.tmp"113⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\DF63.tmp"C:\Users\Admin\AppData\Local\Temp\DF63.tmp"114⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"115⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"116⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"117⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\E109.tmp"C:\Users\Admin\AppData\Local\Temp\E109.tmp"118⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"119⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"120⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"121⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"122⤵PID:2524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-