Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 17:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-13_0110b0cd0e7afe8a90d3b43a2214efb3_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-13_0110b0cd0e7afe8a90d3b43a2214efb3_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-13_0110b0cd0e7afe8a90d3b43a2214efb3_mafia.exe
-
Size
486KB
-
MD5
0110b0cd0e7afe8a90d3b43a2214efb3
-
SHA1
0d68f153ed017df7a007f718fdd466e486849800
-
SHA256
4ce1aa9516dc0018b9d6aab020cd717b83519dc05b6e408120300e3e336c0d85
-
SHA512
5fcd7e999f7e05a696f81951c25a2587f4a25915328bbd63d061f34971b228204db5eea6b2d9a5b9ef33fb2d46a3b0d4659e01202135910625cdd57429b6cc33
-
SSDEEP
12288:/U5rCOTeiDKZ1ZTPiNbIkLjpTYVTZ7xtNZ:/UQOJDSZTPiNbIalTYV1N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3508 E0AB.tmp 1768 E157.tmp 2564 E1F4.tmp 2096 E280.tmp 2836 E30D.tmp 3888 E37A.tmp 4020 E3F7.tmp 2288 E465.tmp 1320 E510.tmp 4376 E56E.tmp 2184 E5EB.tmp 3448 E639.tmp 4064 E6B6.tmp 3068 E724.tmp 2536 E781.tmp 4532 E7DF.tmp 1800 E85C.tmp 1128 E8AA.tmp 2804 E947.tmp 1920 E9B4.tmp 4704 EA41.tmp 636 EAEC.tmp 1540 EB5A.tmp 5112 EBB8.tmp 4000 EC15.tmp 3220 EC83.tmp 1728 ECF0.tmp 4512 ED7D.tmp 3592 EDFA.tmp 2612 EE57.tmp 2500 EEB5.tmp 4392 EF23.tmp 1036 EFA0.tmp 2792 EFFD.tmp 3292 F06B.tmp 4536 F0B9.tmp 1892 F107.tmp 3888 F165.tmp 3808 F1B3.tmp 4372 F211.tmp 3556 F26E.tmp 1200 F2BC.tmp 1608 F31A.tmp 2264 F378.tmp 1720 F3E5.tmp 4092 F443.tmp 4064 F4A1.tmp 2416 F4FF.tmp 2304 F56C.tmp 4848 F5CA.tmp 1624 F627.tmp 2960 F685.tmp 5088 F6E3.tmp 372 F731.tmp 1792 F78F.tmp 4640 F7ED.tmp 4268 F83B.tmp 2976 F898.tmp 3076 F8E7.tmp 636 F935.tmp 4560 F992.tmp 1444 F9E1.tmp 2024 FA4E.tmp 3708 FA9C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 3508 2372 2024-05-13_0110b0cd0e7afe8a90d3b43a2214efb3_mafia.exe 89 PID 2372 wrote to memory of 3508 2372 2024-05-13_0110b0cd0e7afe8a90d3b43a2214efb3_mafia.exe 89 PID 2372 wrote to memory of 3508 2372 2024-05-13_0110b0cd0e7afe8a90d3b43a2214efb3_mafia.exe 89 PID 3508 wrote to memory of 1768 3508 E0AB.tmp 90 PID 3508 wrote to memory of 1768 3508 E0AB.tmp 90 PID 3508 wrote to memory of 1768 3508 E0AB.tmp 90 PID 1768 wrote to memory of 2564 1768 E157.tmp 93 PID 1768 wrote to memory of 2564 1768 E157.tmp 93 PID 1768 wrote to memory of 2564 1768 E157.tmp 93 PID 2564 wrote to memory of 2096 2564 E1F4.tmp 95 PID 2564 wrote to memory of 2096 2564 E1F4.tmp 95 PID 2564 wrote to memory of 2096 2564 E1F4.tmp 95 PID 2096 wrote to memory of 2836 2096 E280.tmp 96 PID 2096 wrote to memory of 2836 2096 E280.tmp 96 PID 2096 wrote to memory of 2836 2096 E280.tmp 96 PID 2836 wrote to memory of 3888 2836 E30D.tmp 97 PID 2836 wrote to memory of 3888 2836 E30D.tmp 97 PID 2836 wrote to memory of 3888 2836 E30D.tmp 97 PID 3888 wrote to memory of 4020 3888 E37A.tmp 98 PID 3888 wrote to memory of 4020 3888 E37A.tmp 98 PID 3888 wrote to memory of 4020 3888 E37A.tmp 98 PID 4020 wrote to memory of 2288 4020 E3F7.tmp 99 PID 4020 wrote to memory of 2288 4020 E3F7.tmp 99 PID 4020 wrote to memory of 2288 4020 E3F7.tmp 99 PID 2288 wrote to memory of 1320 2288 E465.tmp 100 PID 2288 wrote to memory of 1320 2288 E465.tmp 100 PID 2288 wrote to memory of 1320 2288 E465.tmp 100 PID 1320 wrote to memory of 4376 1320 E510.tmp 101 PID 1320 wrote to memory of 4376 1320 E510.tmp 101 PID 1320 wrote to memory of 4376 1320 E510.tmp 101 PID 4376 wrote to memory of 2184 4376 E56E.tmp 102 PID 4376 wrote to memory of 2184 4376 E56E.tmp 102 PID 4376 wrote to memory of 2184 4376 E56E.tmp 102 PID 2184 wrote to memory of 3448 2184 E5EB.tmp 103 PID 2184 wrote to memory of 3448 2184 E5EB.tmp 103 PID 2184 wrote to memory of 3448 2184 E5EB.tmp 103 PID 3448 wrote to memory of 4064 3448 E639.tmp 104 PID 3448 wrote to memory of 4064 3448 E639.tmp 104 PID 3448 wrote to memory of 4064 3448 E639.tmp 104 PID 4064 wrote to memory of 3068 4064 E6B6.tmp 105 PID 4064 wrote to memory of 3068 4064 E6B6.tmp 105 PID 4064 wrote to memory of 3068 4064 E6B6.tmp 105 PID 3068 wrote to memory of 2536 3068 E724.tmp 106 PID 3068 wrote to memory of 2536 3068 E724.tmp 106 PID 3068 wrote to memory of 2536 3068 E724.tmp 106 PID 2536 wrote to memory of 4532 2536 E781.tmp 107 PID 2536 wrote to memory of 4532 2536 E781.tmp 107 PID 2536 wrote to memory of 4532 2536 E781.tmp 107 PID 4532 wrote to memory of 1800 4532 E7DF.tmp 109 PID 4532 wrote to memory of 1800 4532 E7DF.tmp 109 PID 4532 wrote to memory of 1800 4532 E7DF.tmp 109 PID 1800 wrote to memory of 1128 1800 E85C.tmp 110 PID 1800 wrote to memory of 1128 1800 E85C.tmp 110 PID 1800 wrote to memory of 1128 1800 E85C.tmp 110 PID 1128 wrote to memory of 2804 1128 E8AA.tmp 111 PID 1128 wrote to memory of 2804 1128 E8AA.tmp 111 PID 1128 wrote to memory of 2804 1128 E8AA.tmp 111 PID 2804 wrote to memory of 1920 2804 E947.tmp 112 PID 2804 wrote to memory of 1920 2804 E947.tmp 112 PID 2804 wrote to memory of 1920 2804 E947.tmp 112 PID 1920 wrote to memory of 4704 1920 E9B4.tmp 113 PID 1920 wrote to memory of 4704 1920 E9B4.tmp 113 PID 1920 wrote to memory of 4704 1920 E9B4.tmp 113 PID 4704 wrote to memory of 636 4704 EA41.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-13_0110b0cd0e7afe8a90d3b43a2214efb3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-13_0110b0cd0e7afe8a90d3b43a2214efb3_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\E157.tmp"C:\Users\Admin\AppData\Local\Temp\E157.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\E56E.tmp"C:\Users\Admin\AppData\Local\Temp\E56E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\E781.tmp"C:\Users\Admin\AppData\Local\Temp\E781.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\E947.tmp"C:\Users\Admin\AppData\Local\Temp\E947.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\EA41.tmp"C:\Users\Admin\AppData\Local\Temp\EA41.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"23⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"24⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"25⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"26⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\EC83.tmp"C:\Users\Admin\AppData\Local\Temp\EC83.tmp"27⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"28⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"29⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"30⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"31⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"32⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\EF23.tmp"C:\Users\Admin\AppData\Local\Temp\EF23.tmp"33⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"34⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"35⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\F06B.tmp"C:\Users\Admin\AppData\Local\Temp\F06B.tmp"36⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"37⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\F107.tmp"C:\Users\Admin\AppData\Local\Temp\F107.tmp"38⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\F165.tmp"C:\Users\Admin\AppData\Local\Temp\F165.tmp"39⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"40⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"41⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\F26E.tmp"C:\Users\Admin\AppData\Local\Temp\F26E.tmp"42⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"43⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"44⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\F378.tmp"C:\Users\Admin\AppData\Local\Temp\F378.tmp"45⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"46⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\F443.tmp"C:\Users\Admin\AppData\Local\Temp\F443.tmp"47⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"48⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"49⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\F56C.tmp"C:\Users\Admin\AppData\Local\Temp\F56C.tmp"50⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"51⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"52⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"53⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"54⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"55⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"56⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"57⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\F83B.tmp"C:\Users\Admin\AppData\Local\Temp\F83B.tmp"58⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"59⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"60⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\F935.tmp"C:\Users\Admin\AppData\Local\Temp\F935.tmp"61⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\F992.tmp"C:\Users\Admin\AppData\Local\Temp\F992.tmp"62⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"63⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"64⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"65⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"66⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\FB58.tmp"C:\Users\Admin\AppData\Local\Temp\FB58.tmp"67⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"68⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"69⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"70⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"71⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"72⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"73⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"74⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\FE36.tmp"C:\Users\Admin\AppData\Local\Temp\FE36.tmp"75⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\FE84.tmp"C:\Users\Admin\AppData\Local\Temp\FE84.tmp"76⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\FED2.tmp"C:\Users\Admin\AppData\Local\Temp\FED2.tmp"77⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"78⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"79⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"80⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\2A.tmp"C:\Users\Admin\AppData\Local\Temp\2A.tmp"81⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\88.tmp"C:\Users\Admin\AppData\Local\Temp\88.tmp"82⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\D6.tmp"C:\Users\Admin\AppData\Local\Temp\D6.tmp"83⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"84⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"85⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\1DF.tmp"C:\Users\Admin\AppData\Local\Temp\1DF.tmp"86⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"87⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"88⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"89⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"90⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\395.tmp"C:\Users\Admin\AppData\Local\Temp\395.tmp"91⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"92⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\450.tmp"C:\Users\Admin\AppData\Local\Temp\450.tmp"93⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"94⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\4FC.tmp"C:\Users\Admin\AppData\Local\Temp\4FC.tmp"95⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"96⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"97⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp"98⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"99⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\6B2.tmp"C:\Users\Admin\AppData\Local\Temp\6B2.tmp"100⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"101⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\75E.tmp"C:\Users\Admin\AppData\Local\Temp\75E.tmp"102⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"103⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\819.tmp"C:\Users\Admin\AppData\Local\Temp\819.tmp"104⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"105⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\8C5.tmp"C:\Users\Admin\AppData\Local\Temp\8C5.tmp"106⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"107⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"108⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"109⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\A3C.tmp"C:\Users\Admin\AppData\Local\Temp\A3C.tmp"110⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"111⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"112⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"113⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"114⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\C11.tmp"C:\Users\Admin\AppData\Local\Temp\C11.tmp"115⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"116⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\CCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCC.tmp"117⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"118⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"119⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"120⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"121⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"122⤵PID:2612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-