Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 06:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-21_7c49eadf66b820214a851834dafdd388_mafia.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-21_7c49eadf66b820214a851834dafdd388_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-21_7c49eadf66b820214a851834dafdd388_mafia.exe
-
Size
527KB
-
MD5
7c49eadf66b820214a851834dafdd388
-
SHA1
615bd77d1f541843de3a172d20daab699d51ecba
-
SHA256
66c95f4226daa12015ea8662e0a11cbfc9f86bf6ffaa423363585a309b9eea61
-
SHA512
1c489dbee3d3eb2868f1968bae1e7aede039b30a168af6ef93ff02c8a3a87af4f9bff3a8e358b8466e5b107f8fc6c100ccb4ac959967736c5a5b57fa1c692d53
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYJhzjdFOnkk32QmE4bE3eSEJE9pgIW/eYZsHU:fU5rCOTeidw9FPuJmEgE3eHl/PeDZu
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3624 ECB2.tmp 3512 ED1F.tmp 5008 ED8C.tmp 4828 EE09.tmp 2436 EE96.tmp 3856 EF03.tmp 1892 EF80.tmp 3204 F00D.tmp 2788 F08A.tmp 4124 F0D8.tmp 788 F126.tmp 804 F174.tmp 4336 F1F1.tmp 4816 F23F.tmp 880 F28E.tmp 1708 F2FB.tmp 3304 F359.tmp 848 F3B6.tmp 2404 F414.tmp 3312 F482.tmp 4300 F4DF.tmp 1648 F55C.tmp 1264 F5BA.tmp 4684 F608.tmp 4384 F676.tmp 400 F6D3.tmp 3220 F721.tmp 1740 F7DD.tmp 1052 F82B.tmp 3512 F898.tmp 1252 F8E7.tmp 4828 F964.tmp 3084 FA00.tmp 2740 FA5E.tmp 1996 FAAC.tmp 2904 FB09.tmp 4504 FB58.tmp 4888 FBB5.tmp 2172 FC03.tmp 3516 FC61.tmp 2044 FCBF.tmp 4220 FD1D.tmp 2000 FD6B.tmp 2208 FDC9.tmp 2548 FE17.tmp 1904 FE84.tmp 2340 FEE2.tmp 3196 FF4F.tmp 4248 FFAD.tmp 228 B.tmp 4768 68.tmp 1476 C6.tmp 4200 124.tmp 2464 182.tmp 4684 1DF.tmp 4384 23D.tmp 2800 29B.tmp 4592 2E9.tmp 2232 347.tmp 3624 3A5.tmp 2984 402.tmp 1052 460.tmp 1040 4AE.tmp 3184 50C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4624 wrote to memory of 3624 4624 2024-05-21_7c49eadf66b820214a851834dafdd388_mafia.exe 90 PID 4624 wrote to memory of 3624 4624 2024-05-21_7c49eadf66b820214a851834dafdd388_mafia.exe 90 PID 4624 wrote to memory of 3624 4624 2024-05-21_7c49eadf66b820214a851834dafdd388_mafia.exe 90 PID 3624 wrote to memory of 3512 3624 ECB2.tmp 91 PID 3624 wrote to memory of 3512 3624 ECB2.tmp 91 PID 3624 wrote to memory of 3512 3624 ECB2.tmp 91 PID 3512 wrote to memory of 5008 3512 ED1F.tmp 92 PID 3512 wrote to memory of 5008 3512 ED1F.tmp 92 PID 3512 wrote to memory of 5008 3512 ED1F.tmp 92 PID 5008 wrote to memory of 4828 5008 ED8C.tmp 94 PID 5008 wrote to memory of 4828 5008 ED8C.tmp 94 PID 5008 wrote to memory of 4828 5008 ED8C.tmp 94 PID 4828 wrote to memory of 2436 4828 EE09.tmp 96 PID 4828 wrote to memory of 2436 4828 EE09.tmp 96 PID 4828 wrote to memory of 2436 4828 EE09.tmp 96 PID 2436 wrote to memory of 3856 2436 EE96.tmp 97 PID 2436 wrote to memory of 3856 2436 EE96.tmp 97 PID 2436 wrote to memory of 3856 2436 EE96.tmp 97 PID 3856 wrote to memory of 1892 3856 EF03.tmp 98 PID 3856 wrote to memory of 1892 3856 EF03.tmp 98 PID 3856 wrote to memory of 1892 3856 EF03.tmp 98 PID 1892 wrote to memory of 3204 1892 EF80.tmp 100 PID 1892 wrote to memory of 3204 1892 EF80.tmp 100 PID 1892 wrote to memory of 3204 1892 EF80.tmp 100 PID 3204 wrote to memory of 2788 3204 F00D.tmp 101 PID 3204 wrote to memory of 2788 3204 F00D.tmp 101 PID 3204 wrote to memory of 2788 3204 F00D.tmp 101 PID 2788 wrote to memory of 4124 2788 F08A.tmp 102 PID 2788 wrote to memory of 4124 2788 F08A.tmp 102 PID 2788 wrote to memory of 4124 2788 F08A.tmp 102 PID 4124 wrote to memory of 788 4124 F0D8.tmp 103 PID 4124 wrote to memory of 788 4124 F0D8.tmp 103 PID 4124 wrote to memory of 788 4124 F0D8.tmp 103 PID 788 wrote to memory of 804 788 F126.tmp 104 PID 788 wrote to memory of 804 788 F126.tmp 104 PID 788 wrote to memory of 804 788 F126.tmp 104 PID 804 wrote to memory of 4336 804 F174.tmp 105 PID 804 wrote to memory of 4336 804 F174.tmp 105 PID 804 wrote to memory of 4336 804 F174.tmp 105 PID 4336 wrote to memory of 4816 4336 F1F1.tmp 106 PID 4336 wrote to memory of 4816 4336 F1F1.tmp 106 PID 4336 wrote to memory of 4816 4336 F1F1.tmp 106 PID 4816 wrote to memory of 880 4816 F23F.tmp 107 PID 4816 wrote to memory of 880 4816 F23F.tmp 107 PID 4816 wrote to memory of 880 4816 F23F.tmp 107 PID 880 wrote to memory of 1708 880 F28E.tmp 108 PID 880 wrote to memory of 1708 880 F28E.tmp 108 PID 880 wrote to memory of 1708 880 F28E.tmp 108 PID 1708 wrote to memory of 3304 1708 F2FB.tmp 109 PID 1708 wrote to memory of 3304 1708 F2FB.tmp 109 PID 1708 wrote to memory of 3304 1708 F2FB.tmp 109 PID 3304 wrote to memory of 848 3304 F359.tmp 110 PID 3304 wrote to memory of 848 3304 F359.tmp 110 PID 3304 wrote to memory of 848 3304 F359.tmp 110 PID 848 wrote to memory of 2404 848 F3B6.tmp 111 PID 848 wrote to memory of 2404 848 F3B6.tmp 111 PID 848 wrote to memory of 2404 848 F3B6.tmp 111 PID 2404 wrote to memory of 3312 2404 F414.tmp 112 PID 2404 wrote to memory of 3312 2404 F414.tmp 112 PID 2404 wrote to memory of 3312 2404 F414.tmp 112 PID 3312 wrote to memory of 4300 3312 F482.tmp 113 PID 3312 wrote to memory of 4300 3312 F482.tmp 113 PID 3312 wrote to memory of 4300 3312 F482.tmp 113 PID 4300 wrote to memory of 1648 4300 F4DF.tmp 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_7c49eadf66b820214a851834dafdd388_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_7c49eadf66b820214a851834dafdd388_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\EE09.tmp"C:\Users\Admin\AppData\Local\Temp\EE09.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\EE96.tmp"C:\Users\Admin\AppData\Local\Temp\EE96.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\EF03.tmp"C:\Users\Admin\AppData\Local\Temp\EF03.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\EF80.tmp"C:\Users\Admin\AppData\Local\Temp\EF80.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\F00D.tmp"C:\Users\Admin\AppData\Local\Temp\F00D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\F23F.tmp"C:\Users\Admin\AppData\Local\Temp\F23F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\F359.tmp"C:\Users\Admin\AppData\Local\Temp\F359.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\F55C.tmp"C:\Users\Admin\AppData\Local\Temp\F55C.tmp"23⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"24⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\F608.tmp"C:\Users\Admin\AppData\Local\Temp\F608.tmp"25⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"26⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"27⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"28⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"29⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"30⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"31⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"32⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"33⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\F964.tmp"C:\Users\Admin\AppData\Local\Temp\F964.tmp"34⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"35⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"36⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"37⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"38⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\FB58.tmp"C:\Users\Admin\AppData\Local\Temp\FB58.tmp"39⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"40⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\FC03.tmp"C:\Users\Admin\AppData\Local\Temp\FC03.tmp"41⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\FC61.tmp"C:\Users\Admin\AppData\Local\Temp\FC61.tmp"42⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"43⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"44⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"45⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"46⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\FE17.tmp"C:\Users\Admin\AppData\Local\Temp\FE17.tmp"47⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\FE84.tmp"C:\Users\Admin\AppData\Local\Temp\FE84.tmp"48⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"49⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"50⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"51⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"52⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\68.tmp"C:\Users\Admin\AppData\Local\Temp\68.tmp"53⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6.tmp"54⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\124.tmp"C:\Users\Admin\AppData\Local\Temp\124.tmp"55⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"56⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\1DF.tmp"C:\Users\Admin\AppData\Local\Temp\1DF.tmp"57⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"58⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\29B.tmp"C:\Users\Admin\AppData\Local\Temp\29B.tmp"59⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"60⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"61⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\3A5.tmp"C:\Users\Admin\AppData\Local\Temp\3A5.tmp"62⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"63⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"64⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"65⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"66⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"67⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"68⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"69⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\673.tmp"C:\Users\Admin\AppData\Local\Temp\673.tmp"70⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\6D1.tmp"C:\Users\Admin\AppData\Local\Temp\6D1.tmp"71⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\72F.tmp"C:\Users\Admin\AppData\Local\Temp\72F.tmp"72⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\78D.tmp"C:\Users\Admin\AppData\Local\Temp\78D.tmp"73⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"74⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"75⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"76⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"77⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"78⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\9BF.tmp"C:\Users\Admin\AppData\Local\Temp\9BF.tmp"79⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"80⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"81⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\AD8.tmp"C:\Users\Admin\AppData\Local\Temp\AD8.tmp"82⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"83⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\B94.tmp"C:\Users\Admin\AppData\Local\Temp\B94.tmp"84⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"85⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"86⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\CAD.tmp"C:\Users\Admin\AppData\Local\Temp\CAD.tmp"87⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"88⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"89⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"90⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"91⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"92⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"93⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"94⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"95⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"96⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"97⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\10A5.tmp"C:\Users\Admin\AppData\Local\Temp\10A5.tmp"98⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\1102.tmp"C:\Users\Admin\AppData\Local\Temp\1102.tmp"99⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"100⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\11BE.tmp"C:\Users\Admin\AppData\Local\Temp\11BE.tmp"101⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"102⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\1279.tmp"C:\Users\Admin\AppData\Local\Temp\1279.tmp"103⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"104⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\1325.tmp"C:\Users\Admin\AppData\Local\Temp\1325.tmp"105⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"106⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"107⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"108⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\146D.tmp"C:\Users\Admin\AppData\Local\Temp\146D.tmp"109⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"110⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"111⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\1558.tmp"C:\Users\Admin\AppData\Local\Temp\1558.tmp"112⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"113⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"114⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"115⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"116⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"117⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\174C.tmp"C:\Users\Admin\AppData\Local\Temp\174C.tmp"118⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\17AA.tmp"C:\Users\Admin\AppData\Local\Temp\17AA.tmp"119⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\17F8.tmp"C:\Users\Admin\AppData\Local\Temp\17F8.tmp"120⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"121⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\18B3.tmp"C:\Users\Admin\AppData\Local\Temp\18B3.tmp"122⤵PID:2060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-