Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 05:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-11_e894cc82b035966830d5b7076940c6eb_mafia.exe
Resource
win7-20240705-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-11_e894cc82b035966830d5b7076940c6eb_mafia.exe
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
2024-07-11_e894cc82b035966830d5b7076940c6eb_mafia.exe
-
Size
712KB
-
MD5
e894cc82b035966830d5b7076940c6eb
-
SHA1
5f0fe2de4d6dd3bf8f6764eba0d1565ee72fe672
-
SHA256
9c1c17f8faa48b2d3f9b3adee91f493624aff8a22d1cce22441b0b23d4c83cb6
-
SHA512
1b99b1166cfacf09d68f0910492c1ff2ec46deeccfa66a4ba486a6b90829d40928515c417815ab3ae168da9b3e2c27869261b7a9d93f0ba6acb6f6203d41da36
-
SSDEEP
12288:FU5rCOTeiDymoEocn5sz2QXy2TGwUUoS9hNZdCvq5TJLCvY90D8/LVBlVk736Y7k:FUQOJDicnYJlTXUUDNnCvq5TJLCvY90E
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1692 8CCF.tmp 2852 8D5B.tmp 5096 8E17.tmp 4672 8EB3.tmp 2540 8F40.tmp 2104 8FAD.tmp 3008 902A.tmp 1856 9097.tmp 2992 9124.tmp 1396 91A1.tmp 2268 922E.tmp 2492 92AB.tmp 5004 9318.tmp 1836 93A5.tmp 3656 9451.tmp 916 94BE.tmp 2244 953B.tmp 3184 9599.tmp 1056 9606.tmp 1336 9664.tmp 4652 96E1.tmp 4684 975E.tmp 4420 97FA.tmp 2620 9877.tmp 396 9923.tmp 3220 9971.tmp 4872 99EE.tmp 4304 9A5B.tmp 2324 9AC9.tmp 1108 9B27.tmp 5092 9BB3.tmp 264 9C40.tmp 1844 9CAD.tmp 4388 9D0B.tmp 3324 9D69.tmp 1600 9DC6.tmp 2488 9E15.tmp 3376 9E72.tmp 1264 9ED0.tmp 4296 9F1E.tmp 436 9F7C.tmp 3688 9FDA.tmp 816 A047.tmp 3216 A0A5.tmp 1796 A103.tmp 2296 A151.tmp 3548 A1AE.tmp 64 A20C.tmp 5096 A26A.tmp 1252 A2C8.tmp 1752 A316.tmp 4544 A364.tmp 2508 A3C2.tmp 1492 A410.tmp 3032 A45E.tmp 2264 A4BC.tmp 808 A50A.tmp 220 A568.tmp 1096 A5C5.tmp 3308 A613.tmp 4088 A681.tmp 3468 A6CF.tmp 3048 A72D.tmp 4960 A78A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4196 wrote to memory of 1692 4196 2024-07-11_e894cc82b035966830d5b7076940c6eb_mafia.exe 83 PID 4196 wrote to memory of 1692 4196 2024-07-11_e894cc82b035966830d5b7076940c6eb_mafia.exe 83 PID 4196 wrote to memory of 1692 4196 2024-07-11_e894cc82b035966830d5b7076940c6eb_mafia.exe 83 PID 1692 wrote to memory of 2852 1692 8CCF.tmp 85 PID 1692 wrote to memory of 2852 1692 8CCF.tmp 85 PID 1692 wrote to memory of 2852 1692 8CCF.tmp 85 PID 2852 wrote to memory of 5096 2852 8D5B.tmp 86 PID 2852 wrote to memory of 5096 2852 8D5B.tmp 86 PID 2852 wrote to memory of 5096 2852 8D5B.tmp 86 PID 5096 wrote to memory of 4672 5096 8E17.tmp 88 PID 5096 wrote to memory of 4672 5096 8E17.tmp 88 PID 5096 wrote to memory of 4672 5096 8E17.tmp 88 PID 4672 wrote to memory of 2540 4672 8EB3.tmp 89 PID 4672 wrote to memory of 2540 4672 8EB3.tmp 89 PID 4672 wrote to memory of 2540 4672 8EB3.tmp 89 PID 2540 wrote to memory of 2104 2540 8F40.tmp 91 PID 2540 wrote to memory of 2104 2540 8F40.tmp 91 PID 2540 wrote to memory of 2104 2540 8F40.tmp 91 PID 2104 wrote to memory of 3008 2104 8FAD.tmp 92 PID 2104 wrote to memory of 3008 2104 8FAD.tmp 92 PID 2104 wrote to memory of 3008 2104 8FAD.tmp 92 PID 3008 wrote to memory of 1856 3008 902A.tmp 94 PID 3008 wrote to memory of 1856 3008 902A.tmp 94 PID 3008 wrote to memory of 1856 3008 902A.tmp 94 PID 1856 wrote to memory of 2992 1856 9097.tmp 95 PID 1856 wrote to memory of 2992 1856 9097.tmp 95 PID 1856 wrote to memory of 2992 1856 9097.tmp 95 PID 2992 wrote to memory of 1396 2992 9124.tmp 96 PID 2992 wrote to memory of 1396 2992 9124.tmp 96 PID 2992 wrote to memory of 1396 2992 9124.tmp 96 PID 1396 wrote to memory of 2268 1396 91A1.tmp 97 PID 1396 wrote to memory of 2268 1396 91A1.tmp 97 PID 1396 wrote to memory of 2268 1396 91A1.tmp 97 PID 2268 wrote to memory of 2492 2268 922E.tmp 98 PID 2268 wrote to memory of 2492 2268 922E.tmp 98 PID 2268 wrote to memory of 2492 2268 922E.tmp 98 PID 2492 wrote to memory of 5004 2492 92AB.tmp 99 PID 2492 wrote to memory of 5004 2492 92AB.tmp 99 PID 2492 wrote to memory of 5004 2492 92AB.tmp 99 PID 5004 wrote to memory of 1836 5004 9318.tmp 100 PID 5004 wrote to memory of 1836 5004 9318.tmp 100 PID 5004 wrote to memory of 1836 5004 9318.tmp 100 PID 1836 wrote to memory of 3656 1836 93A5.tmp 101 PID 1836 wrote to memory of 3656 1836 93A5.tmp 101 PID 1836 wrote to memory of 3656 1836 93A5.tmp 101 PID 3656 wrote to memory of 916 3656 9451.tmp 102 PID 3656 wrote to memory of 916 3656 9451.tmp 102 PID 3656 wrote to memory of 916 3656 9451.tmp 102 PID 916 wrote to memory of 2244 916 94BE.tmp 103 PID 916 wrote to memory of 2244 916 94BE.tmp 103 PID 916 wrote to memory of 2244 916 94BE.tmp 103 PID 2244 wrote to memory of 3184 2244 953B.tmp 104 PID 2244 wrote to memory of 3184 2244 953B.tmp 104 PID 2244 wrote to memory of 3184 2244 953B.tmp 104 PID 3184 wrote to memory of 1056 3184 9599.tmp 105 PID 3184 wrote to memory of 1056 3184 9599.tmp 105 PID 3184 wrote to memory of 1056 3184 9599.tmp 105 PID 1056 wrote to memory of 1336 1056 9606.tmp 106 PID 1056 wrote to memory of 1336 1056 9606.tmp 106 PID 1056 wrote to memory of 1336 1056 9606.tmp 106 PID 1336 wrote to memory of 4652 1336 9664.tmp 107 PID 1336 wrote to memory of 4652 1336 9664.tmp 107 PID 1336 wrote to memory of 4652 1336 9664.tmp 107 PID 4652 wrote to memory of 4684 4652 96E1.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-11_e894cc82b035966830d5b7076940c6eb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-11_e894cc82b035966830d5b7076940c6eb_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"23⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"24⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"25⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"26⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"27⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"28⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"29⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"30⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"31⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"32⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"33⤵
- Executes dropped EXE
PID:264 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"34⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"35⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"36⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"37⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"38⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"39⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"40⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"41⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"42⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"43⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"44⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"45⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"46⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"47⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"48⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"49⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"50⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"51⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"52⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"53⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"54⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"55⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"56⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"57⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"58⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"59⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"60⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"61⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"62⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"63⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"64⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"65⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"66⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"67⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"68⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"69⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"70⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"71⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"72⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"73⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"74⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"75⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"76⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"77⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"78⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"79⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"80⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"81⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"82⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"83⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"84⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"85⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"86⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"87⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"88⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"89⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"90⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"91⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"92⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"93⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"94⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"95⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"96⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"97⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"98⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"99⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"100⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"101⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"102⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"103⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"104⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"105⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"106⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"107⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"108⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"109⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"110⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"111⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"112⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"113⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"114⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"115⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"116⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"117⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"118⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"119⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"120⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"121⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"122⤵PID:448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-