Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 16:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-22_311049f2a705dbe3735d26e86afc5e2c_mafia.exe
Resource
win7-20240704-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-22_311049f2a705dbe3735d26e86afc5e2c_mafia.exe
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
2024-07-22_311049f2a705dbe3735d26e86afc5e2c_mafia.exe
-
Size
486KB
-
MD5
311049f2a705dbe3735d26e86afc5e2c
-
SHA1
e9ec06b51c0e28f9e5980854e0123f4a3e1ae75f
-
SHA256
3480df6789a4919c6f18f364731034936376cd9f02ccdb9929ffb8707bfcfc22
-
SHA512
faf16386ef5c41dcfd52e7079f544032ff4d9f300e2c62a8df1530736baf11d959810a90f5824a9d35c1d002cde96ce07e45ffb696e4c72264aab3ce43204014
-
SSDEEP
12288:/U5rCOTeiDcJ2B79a/Z/ZP4RKpNtxI1kANZ:/UQOJDQq9ax/ZgRylokAN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3456 B2B6.tmp 1432 B323.tmp 1504 B381.tmp 4072 B3DF.tmp 4192 B45C.tmp 4276 B4B9.tmp 2972 B527.tmp 2448 B585.tmp 2592 B5D3.tmp 4700 B640.tmp 4952 B6BD.tmp 4684 B70B.tmp 1972 B769.tmp 2468 B7C7.tmp 2428 B824.tmp 2620 B882.tmp 5112 B8F0.tmp 3452 B94D.tmp 3324 B9AB.tmp 2968 BA18.tmp 2268 BA76.tmp 3996 BAD4.tmp 3016 BB51.tmp 3824 BB9F.tmp 4820 BBED.tmp 1680 BC4B.tmp 3876 BCA9.tmp 3680 BD16.tmp 3988 BD83.tmp 5072 BDE1.tmp 3512 BE4F.tmp 2260 BE9D.tmp 3252 BF39.tmp 4156 BF87.tmp 4528 BFE5.tmp 2936 C033.tmp 4908 C091.tmp 4236 C0DF.tmp 2016 C12D.tmp 1628 C17B.tmp 3940 C1D9.tmp 4508 C227.tmp 1980 C285.tmp 2036 C2D3.tmp 2064 C350.tmp 208 C39E.tmp 4560 C3EC.tmp 1560 C44A.tmp 4240 C4A8.tmp 1208 C505.tmp 1372 C573.tmp 3712 C5D0.tmp 2240 C61F.tmp 4204 C66D.tmp 3064 C6BB.tmp 4992 C728.tmp 4444 C786.tmp 2308 C7D4.tmp 4208 C832.tmp 3756 C880.tmp 3552 C8CE.tmp 1380 C91C.tmp 2420 C97A.tmp 4532 C9D8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 3456 2912 2024-07-22_311049f2a705dbe3735d26e86afc5e2c_mafia.exe 85 PID 2912 wrote to memory of 3456 2912 2024-07-22_311049f2a705dbe3735d26e86afc5e2c_mafia.exe 85 PID 2912 wrote to memory of 3456 2912 2024-07-22_311049f2a705dbe3735d26e86afc5e2c_mafia.exe 85 PID 3456 wrote to memory of 1432 3456 B2B6.tmp 87 PID 3456 wrote to memory of 1432 3456 B2B6.tmp 87 PID 3456 wrote to memory of 1432 3456 B2B6.tmp 87 PID 1432 wrote to memory of 1504 1432 B323.tmp 88 PID 1432 wrote to memory of 1504 1432 B323.tmp 88 PID 1432 wrote to memory of 1504 1432 B323.tmp 88 PID 1504 wrote to memory of 4072 1504 B381.tmp 90 PID 1504 wrote to memory of 4072 1504 B381.tmp 90 PID 1504 wrote to memory of 4072 1504 B381.tmp 90 PID 4072 wrote to memory of 4192 4072 B3DF.tmp 91 PID 4072 wrote to memory of 4192 4072 B3DF.tmp 91 PID 4072 wrote to memory of 4192 4072 B3DF.tmp 91 PID 4192 wrote to memory of 4276 4192 B45C.tmp 92 PID 4192 wrote to memory of 4276 4192 B45C.tmp 92 PID 4192 wrote to memory of 4276 4192 B45C.tmp 92 PID 4276 wrote to memory of 2972 4276 B4B9.tmp 94 PID 4276 wrote to memory of 2972 4276 B4B9.tmp 94 PID 4276 wrote to memory of 2972 4276 B4B9.tmp 94 PID 2972 wrote to memory of 2448 2972 B527.tmp 95 PID 2972 wrote to memory of 2448 2972 B527.tmp 95 PID 2972 wrote to memory of 2448 2972 B527.tmp 95 PID 2448 wrote to memory of 2592 2448 B585.tmp 96 PID 2448 wrote to memory of 2592 2448 B585.tmp 96 PID 2448 wrote to memory of 2592 2448 B585.tmp 96 PID 2592 wrote to memory of 4700 2592 B5D3.tmp 97 PID 2592 wrote to memory of 4700 2592 B5D3.tmp 97 PID 2592 wrote to memory of 4700 2592 B5D3.tmp 97 PID 4700 wrote to memory of 4952 4700 B640.tmp 98 PID 4700 wrote to memory of 4952 4700 B640.tmp 98 PID 4700 wrote to memory of 4952 4700 B640.tmp 98 PID 4952 wrote to memory of 4684 4952 B6BD.tmp 99 PID 4952 wrote to memory of 4684 4952 B6BD.tmp 99 PID 4952 wrote to memory of 4684 4952 B6BD.tmp 99 PID 4684 wrote to memory of 1972 4684 B70B.tmp 100 PID 4684 wrote to memory of 1972 4684 B70B.tmp 100 PID 4684 wrote to memory of 1972 4684 B70B.tmp 100 PID 1972 wrote to memory of 2468 1972 B769.tmp 101 PID 1972 wrote to memory of 2468 1972 B769.tmp 101 PID 1972 wrote to memory of 2468 1972 B769.tmp 101 PID 2468 wrote to memory of 2428 2468 B7C7.tmp 102 PID 2468 wrote to memory of 2428 2468 B7C7.tmp 102 PID 2468 wrote to memory of 2428 2468 B7C7.tmp 102 PID 2428 wrote to memory of 2620 2428 B824.tmp 103 PID 2428 wrote to memory of 2620 2428 B824.tmp 103 PID 2428 wrote to memory of 2620 2428 B824.tmp 103 PID 2620 wrote to memory of 5112 2620 B882.tmp 104 PID 2620 wrote to memory of 5112 2620 B882.tmp 104 PID 2620 wrote to memory of 5112 2620 B882.tmp 104 PID 5112 wrote to memory of 3452 5112 B8F0.tmp 105 PID 5112 wrote to memory of 3452 5112 B8F0.tmp 105 PID 5112 wrote to memory of 3452 5112 B8F0.tmp 105 PID 3452 wrote to memory of 3324 3452 B94D.tmp 106 PID 3452 wrote to memory of 3324 3452 B94D.tmp 106 PID 3452 wrote to memory of 3324 3452 B94D.tmp 106 PID 3324 wrote to memory of 2968 3324 B9AB.tmp 108 PID 3324 wrote to memory of 2968 3324 B9AB.tmp 108 PID 3324 wrote to memory of 2968 3324 B9AB.tmp 108 PID 2968 wrote to memory of 2268 2968 BA18.tmp 109 PID 2968 wrote to memory of 2268 2968 BA18.tmp 109 PID 2968 wrote to memory of 2268 2968 BA18.tmp 109 PID 2268 wrote to memory of 3996 2268 BA76.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-22_311049f2a705dbe3735d26e86afc5e2c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-22_311049f2a705dbe3735d26e86afc5e2c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\B585.tmp"C:\Users\Admin\AppData\Local\Temp\B585.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"23⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"24⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"25⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"26⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"27⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"28⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"29⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"30⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"31⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"32⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"33⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"34⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"35⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"36⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"37⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"38⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"39⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"40⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"41⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"42⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"43⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"44⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"45⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"46⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"47⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"48⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"49⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"50⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"51⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\C573.tmp"C:\Users\Admin\AppData\Local\Temp\C573.tmp"52⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"53⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"54⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"55⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"56⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"57⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"58⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"59⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"60⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"61⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"62⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"63⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"64⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"65⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\CA35.tmp"C:\Users\Admin\AppData\Local\Temp\CA35.tmp"66⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"67⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"68⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"69⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"70⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"71⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\CC68.tmp"C:\Users\Admin\AppData\Local\Temp\CC68.tmp"72⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"73⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"74⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"75⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"76⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"77⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"78⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"79⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"80⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"81⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\D002.tmp"C:\Users\Admin\AppData\Local\Temp\D002.tmp"82⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"83⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"84⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"85⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"86⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"87⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"88⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\D282.tmp"C:\Users\Admin\AppData\Local\Temp\D282.tmp"89⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"90⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\D32E.tmp"C:\Users\Admin\AppData\Local\Temp\D32E.tmp"91⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"92⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"93⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\D428.tmp"C:\Users\Admin\AppData\Local\Temp\D428.tmp"94⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"95⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"96⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\D532.tmp"C:\Users\Admin\AppData\Local\Temp\D532.tmp"97⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\D590.tmp"C:\Users\Admin\AppData\Local\Temp\D590.tmp"98⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"99⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\D63C.tmp"C:\Users\Admin\AppData\Local\Temp\D63C.tmp"100⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"101⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"102⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\D755.tmp"C:\Users\Admin\AppData\Local\Temp\D755.tmp"103⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"104⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"105⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\D86E.tmp"C:\Users\Admin\AppData\Local\Temp\D86E.tmp"106⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"107⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\D92A.tmp"C:\Users\Admin\AppData\Local\Temp\D92A.tmp"108⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\D987.tmp"C:\Users\Admin\AppData\Local\Temp\D987.tmp"109⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"110⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\DA33.tmp"C:\Users\Admin\AppData\Local\Temp\DA33.tmp"111⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\DA91.tmp"C:\Users\Admin\AppData\Local\Temp\DA91.tmp"112⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\DADF.tmp"C:\Users\Admin\AppData\Local\Temp\DADF.tmp"113⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"114⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"115⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"116⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\DC56.tmp"C:\Users\Admin\AppData\Local\Temp\DC56.tmp"117⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"118⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"119⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\DD50.tmp"C:\Users\Admin\AppData\Local\Temp\DD50.tmp"120⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"121⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"122⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-