Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 09:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-09_8aa896bd950281577e6d07166f5e55e0_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-09_8aa896bd950281577e6d07166f5e55e0_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-09_8aa896bd950281577e6d07166f5e55e0_mafia.exe
-
Size
527KB
-
MD5
8aa896bd950281577e6d07166f5e55e0
-
SHA1
ba416d9fbdcadca8985bc1201294f1e9bb0c9716
-
SHA256
54ac67867e2ab7333e5557f7259cf9dd01f1034d0d55c993072fb967170fc555
-
SHA512
4acf4bb1c8e4bbabc8e7893cd6d08135ce4cb5b19e4f55ca1afacef5be2da369c1cf7470b33d4e9a6f3d4439cb0a4eef863f8444e9a4fa1a291836891ac73a1e
-
SSDEEP
12288:fU5rCOTeidK3jZ4XYU34Sv8G6ZHX9/jNTDZu:fUQOJdAZ4XYm4Sv8G6xX/Do
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4196 E5BC.tmp 4820 E61A.tmp 1604 E6A7.tmp 1488 E762.tmp 1256 E7EF.tmp 5068 E87B.tmp 884 E918.tmp 4272 E9A4.tmp 3472 EA12.tmp 4220 EA60.tmp 4100 EABE.tmp 444 EB1B.tmp 5028 EB89.tmp 2368 EBF6.tmp 4940 EC44.tmp 3944 ECC1.tmp 556 ED1F.tmp 4728 EDAC.tmp 2508 EDFA.tmp 4936 EE48.tmp 4072 EEA6.tmp 2968 EEF4.tmp 2748 EF61.tmp 4800 EFCE.tmp 3576 F04B.tmp 4924 F0A9.tmp 3936 F107.tmp 1736 F165.tmp 1088 F1D2.tmp 4988 F24F.tmp 1492 F2AD.tmp 3496 F31A.tmp 3004 F368.tmp 372 F3B6.tmp 4284 F414.tmp 4300 F472.tmp 2944 F4C0.tmp 4740 F51E.tmp 4840 F56C.tmp 4820 F5CA.tmp 2232 F618.tmp 3600 F676.tmp 3196 F6D3.tmp 2556 F731.tmp 1488 F78F.tmp 4336 F7DD.tmp 3548 F82B.tmp 5068 F879.tmp 3728 F8C7.tmp 4792 F906.tmp 1196 F954.tmp 4372 F9A2.tmp 4436 FA00.tmp 2464 FA4E.tmp 1500 FA9C.tmp 2732 FAFA.tmp 312 FB48.tmp 3460 FB96.tmp 4428 FBF4.tmp 4480 FC42.tmp 5024 FCA0.tmp 4940 FCEE.tmp 1612 FD4C.tmp 4864 FDA9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4464 wrote to memory of 4196 4464 2024-05-09_8aa896bd950281577e6d07166f5e55e0_mafia.exe 88 PID 4464 wrote to memory of 4196 4464 2024-05-09_8aa896bd950281577e6d07166f5e55e0_mafia.exe 88 PID 4464 wrote to memory of 4196 4464 2024-05-09_8aa896bd950281577e6d07166f5e55e0_mafia.exe 88 PID 4196 wrote to memory of 4820 4196 E5BC.tmp 90 PID 4196 wrote to memory of 4820 4196 E5BC.tmp 90 PID 4196 wrote to memory of 4820 4196 E5BC.tmp 90 PID 4820 wrote to memory of 1604 4820 E61A.tmp 91 PID 4820 wrote to memory of 1604 4820 E61A.tmp 91 PID 4820 wrote to memory of 1604 4820 E61A.tmp 91 PID 1604 wrote to memory of 1488 1604 E6A7.tmp 93 PID 1604 wrote to memory of 1488 1604 E6A7.tmp 93 PID 1604 wrote to memory of 1488 1604 E6A7.tmp 93 PID 1488 wrote to memory of 1256 1488 E762.tmp 95 PID 1488 wrote to memory of 1256 1488 E762.tmp 95 PID 1488 wrote to memory of 1256 1488 E762.tmp 95 PID 1256 wrote to memory of 5068 1256 E7EF.tmp 96 PID 1256 wrote to memory of 5068 1256 E7EF.tmp 96 PID 1256 wrote to memory of 5068 1256 E7EF.tmp 96 PID 5068 wrote to memory of 884 5068 E87B.tmp 97 PID 5068 wrote to memory of 884 5068 E87B.tmp 97 PID 5068 wrote to memory of 884 5068 E87B.tmp 97 PID 884 wrote to memory of 4272 884 E918.tmp 98 PID 884 wrote to memory of 4272 884 E918.tmp 98 PID 884 wrote to memory of 4272 884 E918.tmp 98 PID 4272 wrote to memory of 3472 4272 E9A4.tmp 99 PID 4272 wrote to memory of 3472 4272 E9A4.tmp 99 PID 4272 wrote to memory of 3472 4272 E9A4.tmp 99 PID 3472 wrote to memory of 4220 3472 EA12.tmp 100 PID 3472 wrote to memory of 4220 3472 EA12.tmp 100 PID 3472 wrote to memory of 4220 3472 EA12.tmp 100 PID 4220 wrote to memory of 4100 4220 EA60.tmp 101 PID 4220 wrote to memory of 4100 4220 EA60.tmp 101 PID 4220 wrote to memory of 4100 4220 EA60.tmp 101 PID 4100 wrote to memory of 444 4100 EABE.tmp 102 PID 4100 wrote to memory of 444 4100 EABE.tmp 102 PID 4100 wrote to memory of 444 4100 EABE.tmp 102 PID 444 wrote to memory of 5028 444 EB1B.tmp 103 PID 444 wrote to memory of 5028 444 EB1B.tmp 103 PID 444 wrote to memory of 5028 444 EB1B.tmp 103 PID 5028 wrote to memory of 2368 5028 EB89.tmp 104 PID 5028 wrote to memory of 2368 5028 EB89.tmp 104 PID 5028 wrote to memory of 2368 5028 EB89.tmp 104 PID 2368 wrote to memory of 4940 2368 EBF6.tmp 105 PID 2368 wrote to memory of 4940 2368 EBF6.tmp 105 PID 2368 wrote to memory of 4940 2368 EBF6.tmp 105 PID 4940 wrote to memory of 3944 4940 EC44.tmp 106 PID 4940 wrote to memory of 3944 4940 EC44.tmp 106 PID 4940 wrote to memory of 3944 4940 EC44.tmp 106 PID 3944 wrote to memory of 556 3944 ECC1.tmp 107 PID 3944 wrote to memory of 556 3944 ECC1.tmp 107 PID 3944 wrote to memory of 556 3944 ECC1.tmp 107 PID 556 wrote to memory of 4728 556 ED1F.tmp 108 PID 556 wrote to memory of 4728 556 ED1F.tmp 108 PID 556 wrote to memory of 4728 556 ED1F.tmp 108 PID 4728 wrote to memory of 2508 4728 EDAC.tmp 109 PID 4728 wrote to memory of 2508 4728 EDAC.tmp 109 PID 4728 wrote to memory of 2508 4728 EDAC.tmp 109 PID 2508 wrote to memory of 4936 2508 EDFA.tmp 110 PID 2508 wrote to memory of 4936 2508 EDFA.tmp 110 PID 2508 wrote to memory of 4936 2508 EDFA.tmp 110 PID 4936 wrote to memory of 4072 4936 EE48.tmp 111 PID 4936 wrote to memory of 4072 4936 EE48.tmp 111 PID 4936 wrote to memory of 4072 4936 EE48.tmp 111 PID 4072 wrote to memory of 2968 4072 EEA6.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-09_8aa896bd950281577e6d07166f5e55e0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-09_8aa896bd950281577e6d07166f5e55e0_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\E61A.tmp"C:\Users\Admin\AppData\Local\Temp\E61A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\E918.tmp"C:\Users\Admin\AppData\Local\Temp\E918.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\EE48.tmp"C:\Users\Admin\AppData\Local\Temp\EE48.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"23⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\EF61.tmp"C:\Users\Admin\AppData\Local\Temp\EF61.tmp"24⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"25⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\F04B.tmp"C:\Users\Admin\AppData\Local\Temp\F04B.tmp"26⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\F0A9.tmp"C:\Users\Admin\AppData\Local\Temp\F0A9.tmp"27⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\F107.tmp"C:\Users\Admin\AppData\Local\Temp\F107.tmp"28⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\F165.tmp"C:\Users\Admin\AppData\Local\Temp\F165.tmp"29⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"30⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\F24F.tmp"C:\Users\Admin\AppData\Local\Temp\F24F.tmp"31⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"32⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"33⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"34⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"35⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"36⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\F472.tmp"C:\Users\Admin\AppData\Local\Temp\F472.tmp"37⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"38⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\F51E.tmp"C:\Users\Admin\AppData\Local\Temp\F51E.tmp"39⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\F56C.tmp"C:\Users\Admin\AppData\Local\Temp\F56C.tmp"40⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"41⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"42⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"43⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"44⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"45⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"46⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"47⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"48⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\F879.tmp"C:\Users\Admin\AppData\Local\Temp\F879.tmp"49⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"50⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"51⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\F954.tmp"C:\Users\Admin\AppData\Local\Temp\F954.tmp"52⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"53⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"54⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"55⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"56⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"57⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\FB48.tmp"C:\Users\Admin\AppData\Local\Temp\FB48.tmp"58⤵
- Executes dropped EXE
PID:312 -
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"59⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"60⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"61⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"62⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"63⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"64⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"65⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"66⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"67⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"68⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\FF11.tmp"C:\Users\Admin\AppData\Local\Temp\FF11.tmp"69⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"70⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"71⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"72⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\68.tmp"C:\Users\Admin\AppData\Local\Temp\68.tmp"73⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6.tmp"74⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\114.tmp"C:\Users\Admin\AppData\Local\Temp\114.tmp"75⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"76⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"77⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"78⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\24D.tmp"C:\Users\Admin\AppData\Local\Temp\24D.tmp"79⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\29B.tmp"C:\Users\Admin\AppData\Local\Temp\29B.tmp"80⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"81⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"82⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\3A5.tmp"C:\Users\Admin\AppData\Local\Temp\3A5.tmp"83⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"84⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"85⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\48F.tmp"C:\Users\Admin\AppData\Local\Temp\48F.tmp"86⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"87⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"88⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"89⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\5F6.tmp"C:\Users\Admin\AppData\Local\Temp\5F6.tmp"90⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"91⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\693.tmp"C:\Users\Admin\AppData\Local\Temp\693.tmp"92⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\6E1.tmp"C:\Users\Admin\AppData\Local\Temp\6E1.tmp"93⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"94⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\78D.tmp"C:\Users\Admin\AppData\Local\Temp\78D.tmp"95⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"96⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"97⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\887.tmp"C:\Users\Admin\AppData\Local\Temp\887.tmp"98⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"99⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"100⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\971.tmp"C:\Users\Admin\AppData\Local\Temp\971.tmp"101⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\9CF.tmp"C:\Users\Admin\AppData\Local\Temp\9CF.tmp"102⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\A0D.tmp"C:\Users\Admin\AppData\Local\Temp\A0D.tmp"103⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"104⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"105⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"106⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\B75.tmp"C:\Users\Admin\AppData\Local\Temp\B75.tmp"107⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\BD2.tmp"C:\Users\Admin\AppData\Local\Temp\BD2.tmp"108⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\C30.tmp"C:\Users\Admin\AppData\Local\Temp\C30.tmp"109⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"110⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"111⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"112⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"113⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"114⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"115⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"116⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"117⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"118⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"119⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"120⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\1018.tmp"C:\Users\Admin\AppData\Local\Temp\1018.tmp"121⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"122⤵PID:2368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-