Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 17:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe
-
Size
712KB
-
MD5
2bc5ba4c574bf6d42a4ead2a96c2957c
-
SHA1
7b6074a6de1eeb32e4653d084ca00d19b42fcd55
-
SHA256
354111cbcb0ea8fc46c596d745aa0b99daf58f7c4a7d2df71f3c81118839aa05
-
SHA512
ae8695bf78c2c5a0c99f9207f4feefcbc4c8f600b1adcc63a7fc23448588367f6a1b00e60217b0b2166d7a30b1c32c9bd05d8940586bcd7f5447e337d991b6da
-
SSDEEP
12288:FU5rCOTeiDeDK0pgq81lHxkE1EWLXHY2nqG/eNZdCvq5TJLCvY90D8/LVBlVk730:FUQOJDsuq8THxkCvXY2jeNnCvq5TJLC0
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 536 B8B1.tmp 3228 B92E.tmp 4672 B9AB.tmp 5068 BA28.tmp 4364 BA95.tmp 2728 BB12.tmp 4656 BC6A.tmp 1388 BCE7.tmp 4040 BD45.tmp 1960 BDB2.tmp 3148 BE00.tmp 2236 BE5E.tmp 5096 BEDB.tmp 4644 BF58.tmp 184 BFD5.tmp 4652 C062.tmp 1596 C0EE.tmp 4456 C13D.tmp 4304 C1BA.tmp 216 C237.tmp 1312 C294.tmp 1408 C311.tmp 2432 C37F.tmp 520 C3FC.tmp 2676 C459.tmp 2828 C4D6.tmp 920 C563.tmp 2396 C5D0.tmp 924 C63E.tmp 3732 C6BB.tmp 1708 C747.tmp 2924 C7C4.tmp 1172 C832.tmp 3344 C880.tmp 1224 C8DE.tmp 984 C92C.tmp 2752 C97A.tmp 1556 C9D8.tmp 2464 CA26.tmp 1888 CA84.tmp 408 CAE1.tmp 3392 CB2F.tmp 3512 CB7E.tmp 4024 CBCC.tmp 4616 CC1A.tmp 3672 CCA6.tmp 4428 CD04.tmp 3412 CD52.tmp 1444 CDB0.tmp 2876 CDFE.tmp 3568 CE4C.tmp 1472 CE9A.tmp 4692 CEF8.tmp 2032 CF46.tmp 1304 CF94.tmp 2964 CFF2.tmp 4088 D050.tmp 5068 D0AE.tmp 2620 D11B.tmp 1868 D179.tmp 556 D1D7.tmp 544 D234.tmp 2768 D292.tmp 928 D2E0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1080 wrote to memory of 536 1080 2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe 82 PID 1080 wrote to memory of 536 1080 2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe 82 PID 1080 wrote to memory of 536 1080 2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe 82 PID 536 wrote to memory of 3228 536 B8B1.tmp 84 PID 536 wrote to memory of 3228 536 B8B1.tmp 84 PID 536 wrote to memory of 3228 536 B8B1.tmp 84 PID 3228 wrote to memory of 4672 3228 B92E.tmp 85 PID 3228 wrote to memory of 4672 3228 B92E.tmp 85 PID 3228 wrote to memory of 4672 3228 B92E.tmp 85 PID 4672 wrote to memory of 5068 4672 B9AB.tmp 87 PID 4672 wrote to memory of 5068 4672 B9AB.tmp 87 PID 4672 wrote to memory of 5068 4672 B9AB.tmp 87 PID 5068 wrote to memory of 4364 5068 BA28.tmp 88 PID 5068 wrote to memory of 4364 5068 BA28.tmp 88 PID 5068 wrote to memory of 4364 5068 BA28.tmp 88 PID 4364 wrote to memory of 2728 4364 BA95.tmp 90 PID 4364 wrote to memory of 2728 4364 BA95.tmp 90 PID 4364 wrote to memory of 2728 4364 BA95.tmp 90 PID 2728 wrote to memory of 4656 2728 BB12.tmp 91 PID 2728 wrote to memory of 4656 2728 BB12.tmp 91 PID 2728 wrote to memory of 4656 2728 BB12.tmp 91 PID 4656 wrote to memory of 1388 4656 BC6A.tmp 92 PID 4656 wrote to memory of 1388 4656 BC6A.tmp 92 PID 4656 wrote to memory of 1388 4656 BC6A.tmp 92 PID 1388 wrote to memory of 4040 1388 BCE7.tmp 93 PID 1388 wrote to memory of 4040 1388 BCE7.tmp 93 PID 1388 wrote to memory of 4040 1388 BCE7.tmp 93 PID 4040 wrote to memory of 1960 4040 BD45.tmp 94 PID 4040 wrote to memory of 1960 4040 BD45.tmp 94 PID 4040 wrote to memory of 1960 4040 BD45.tmp 94 PID 1960 wrote to memory of 3148 1960 BDB2.tmp 95 PID 1960 wrote to memory of 3148 1960 BDB2.tmp 95 PID 1960 wrote to memory of 3148 1960 BDB2.tmp 95 PID 3148 wrote to memory of 2236 3148 BE00.tmp 96 PID 3148 wrote to memory of 2236 3148 BE00.tmp 96 PID 3148 wrote to memory of 2236 3148 BE00.tmp 96 PID 2236 wrote to memory of 5096 2236 BE5E.tmp 97 PID 2236 wrote to memory of 5096 2236 BE5E.tmp 97 PID 2236 wrote to memory of 5096 2236 BE5E.tmp 97 PID 5096 wrote to memory of 4644 5096 BEDB.tmp 98 PID 5096 wrote to memory of 4644 5096 BEDB.tmp 98 PID 5096 wrote to memory of 4644 5096 BEDB.tmp 98 PID 4644 wrote to memory of 184 4644 BF58.tmp 99 PID 4644 wrote to memory of 184 4644 BF58.tmp 99 PID 4644 wrote to memory of 184 4644 BF58.tmp 99 PID 184 wrote to memory of 4652 184 BFD5.tmp 100 PID 184 wrote to memory of 4652 184 BFD5.tmp 100 PID 184 wrote to memory of 4652 184 BFD5.tmp 100 PID 4652 wrote to memory of 1596 4652 C062.tmp 101 PID 4652 wrote to memory of 1596 4652 C062.tmp 101 PID 4652 wrote to memory of 1596 4652 C062.tmp 101 PID 1596 wrote to memory of 4456 1596 C0EE.tmp 102 PID 1596 wrote to memory of 4456 1596 C0EE.tmp 102 PID 1596 wrote to memory of 4456 1596 C0EE.tmp 102 PID 4456 wrote to memory of 4304 4456 C13D.tmp 103 PID 4456 wrote to memory of 4304 4456 C13D.tmp 103 PID 4456 wrote to memory of 4304 4456 C13D.tmp 103 PID 4304 wrote to memory of 216 4304 C1BA.tmp 104 PID 4304 wrote to memory of 216 4304 C1BA.tmp 104 PID 4304 wrote to memory of 216 4304 C1BA.tmp 104 PID 216 wrote to memory of 1312 216 C237.tmp 105 PID 216 wrote to memory of 1312 216 C237.tmp 105 PID 216 wrote to memory of 1312 216 C237.tmp 105 PID 1312 wrote to memory of 1408 1312 C294.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\BE00.tmp"C:\Users\Admin\AppData\Local\Temp\BE00.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:184 -
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"23⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"24⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"25⤵
- Executes dropped EXE
PID:520 -
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"26⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"27⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"28⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"29⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"30⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"31⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\C747.tmp"C:\Users\Admin\AppData\Local\Temp\C747.tmp"32⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"33⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"34⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"35⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"36⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"37⤵
- Executes dropped EXE
PID:984 -
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"38⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"39⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"40⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"41⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"42⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"43⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"44⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"45⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"46⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"47⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\CD04.tmp"C:\Users\Admin\AppData\Local\Temp\CD04.tmp"48⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\CD52.tmp"C:\Users\Admin\AppData\Local\Temp\CD52.tmp"49⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"50⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"51⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"52⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"53⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"C:\Users\Admin\AppData\Local\Temp\CEF8.tmp"54⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"55⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\CF94.tmp"C:\Users\Admin\AppData\Local\Temp\CF94.tmp"56⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"57⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"58⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"59⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"60⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"61⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"62⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"63⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"64⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"65⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\D33E.tmp"C:\Users\Admin\AppData\Local\Temp\D33E.tmp"66⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"67⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"68⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\D467.tmp"C:\Users\Admin\AppData\Local\Temp\D467.tmp"69⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"70⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"71⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\D580.tmp"C:\Users\Admin\AppData\Local\Temp\D580.tmp"72⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"73⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\D63C.tmp"C:\Users\Admin\AppData\Local\Temp\D63C.tmp"74⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"75⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"76⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\D745.tmp"C:\Users\Admin\AppData\Local\Temp\D745.tmp"77⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"78⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\D801.tmp"C:\Users\Admin\AppData\Local\Temp\D801.tmp"79⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"80⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"81⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"82⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\D978.tmp"C:\Users\Admin\AppData\Local\Temp\D978.tmp"83⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"84⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\DA24.tmp"C:\Users\Admin\AppData\Local\Temp\DA24.tmp"85⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\DA72.tmp"C:\Users\Admin\AppData\Local\Temp\DA72.tmp"86⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"87⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"88⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"89⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"90⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\DC27.tmp"C:\Users\Admin\AppData\Local\Temp\DC27.tmp"91⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"92⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"93⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\DD40.tmp"C:\Users\Admin\AppData\Local\Temp\DD40.tmp"94⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"95⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"96⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"97⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"98⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"99⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\DF34.tmp"C:\Users\Admin\AppData\Local\Temp\DF34.tmp"100⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\DF83.tmp"C:\Users\Admin\AppData\Local\Temp\DF83.tmp"101⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"102⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\E01F.tmp"C:\Users\Admin\AppData\Local\Temp\E01F.tmp"103⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\E07D.tmp"C:\Users\Admin\AppData\Local\Temp\E07D.tmp"104⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"105⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\E138.tmp"C:\Users\Admin\AppData\Local\Temp\E138.tmp"106⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"107⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"108⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\E251.tmp"C:\Users\Admin\AppData\Local\Temp\E251.tmp"109⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\E29F.tmp"C:\Users\Admin\AppData\Local\Temp\E29F.tmp"110⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"111⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"112⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"113⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\E416.tmp"C:\Users\Admin\AppData\Local\Temp\E416.tmp"114⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"115⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"116⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"117⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\E56E.tmp"C:\Users\Admin\AppData\Local\Temp\E56E.tmp"118⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"119⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\E62A.tmp"C:\Users\Admin\AppData\Local\Temp\E62A.tmp"120⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"121⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"122⤵PID:5064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-