Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 20:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe
-
Size
541KB
-
MD5
0f971bea56fdef26518e6cb850ea18c4
-
SHA1
dde216fff38d11fed036f266ac1a59d3335d2d3f
-
SHA256
695a6ccb16582bbeebb991bb6a3ad643c0dd32f46dc9eec7c2d6e7b019a68619
-
SHA512
1219400bf1355c56ce5d01540157e9870f4c29471999890ade6e49d5eef0818dc73f1cb0e411352b068073a7a601a247ac2cb53baa7589f35009ac77cd0df4ac
-
SSDEEP
12288:UU5rCOTeifjDBt4/AgnsFcIkRkxSVpZ2rZa73ctO:UUQOJf3s7sFXNrU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2260 E05D.tmp 3580 E0BB.tmp 3268 E157.tmp 4148 E1B5.tmp 4496 E251.tmp 1800 E2BF.tmp 1164 E32C.tmp 1956 E3A9.tmp 4456 E426.tmp 4300 E4B3.tmp 1568 E53F.tmp 4160 E5BC.tmp 1360 E61A.tmp 5056 E687.tmp 1236 E704.tmp 3956 E772.tmp 2076 E7C0.tmp 3024 E81E.tmp 232 E88B.tmp 1324 E8E9.tmp 4424 E937.tmp 3448 E9B4.tmp 4340 EA12.tmp 1020 EA6F.tmp 432 EABE.tmp 2556 EB2B.tmp 4248 EB98.tmp 2516 EC15.tmp 3596 EC83.tmp 4172 ECE0.tmp 1052 ED3E.tmp 4160 ED9C.tmp 4844 EE38.tmp 1732 EE86.tmp 3952 EEE4.tmp 4644 EF42.tmp 116 EFA0.tmp 1224 EFEE.tmp 672 F03C.tmp 3232 F08A.tmp 3092 F0D8.tmp 2500 F126.tmp 4656 F1C2.tmp 4340 F220.tmp 1472 F27E.tmp 4004 F2CC.tmp 432 F31A.tmp 3868 F378.tmp 1176 F3D6.tmp 3516 F433.tmp 4244 F491.tmp 4864 F4EF.tmp 2712 F54D.tmp 2168 F59B.tmp 1360 F5F9.tmp 4468 F656.tmp 3420 F6B4.tmp 2604 F712.tmp 3012 F770.tmp 1532 F7CD.tmp 2348 F81B.tmp 3676 F879.tmp 4604 F8D7.tmp 4152 F935.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1384 wrote to memory of 2260 1384 2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe 91 PID 1384 wrote to memory of 2260 1384 2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe 91 PID 1384 wrote to memory of 2260 1384 2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe 91 PID 2260 wrote to memory of 3580 2260 E05D.tmp 92 PID 2260 wrote to memory of 3580 2260 E05D.tmp 92 PID 2260 wrote to memory of 3580 2260 E05D.tmp 92 PID 3580 wrote to memory of 3268 3580 E0BB.tmp 93 PID 3580 wrote to memory of 3268 3580 E0BB.tmp 93 PID 3580 wrote to memory of 3268 3580 E0BB.tmp 93 PID 3268 wrote to memory of 4148 3268 E157.tmp 95 PID 3268 wrote to memory of 4148 3268 E157.tmp 95 PID 3268 wrote to memory of 4148 3268 E157.tmp 95 PID 4148 wrote to memory of 4496 4148 E1B5.tmp 97 PID 4148 wrote to memory of 4496 4148 E1B5.tmp 97 PID 4148 wrote to memory of 4496 4148 E1B5.tmp 97 PID 4496 wrote to memory of 1800 4496 E251.tmp 98 PID 4496 wrote to memory of 1800 4496 E251.tmp 98 PID 4496 wrote to memory of 1800 4496 E251.tmp 98 PID 1800 wrote to memory of 1164 1800 E2BF.tmp 100 PID 1800 wrote to memory of 1164 1800 E2BF.tmp 100 PID 1800 wrote to memory of 1164 1800 E2BF.tmp 100 PID 1164 wrote to memory of 1956 1164 E32C.tmp 101 PID 1164 wrote to memory of 1956 1164 E32C.tmp 101 PID 1164 wrote to memory of 1956 1164 E32C.tmp 101 PID 1956 wrote to memory of 4456 1956 E3A9.tmp 102 PID 1956 wrote to memory of 4456 1956 E3A9.tmp 102 PID 1956 wrote to memory of 4456 1956 E3A9.tmp 102 PID 4456 wrote to memory of 4300 4456 E426.tmp 103 PID 4456 wrote to memory of 4300 4456 E426.tmp 103 PID 4456 wrote to memory of 4300 4456 E426.tmp 103 PID 4300 wrote to memory of 1568 4300 E4B3.tmp 104 PID 4300 wrote to memory of 1568 4300 E4B3.tmp 104 PID 4300 wrote to memory of 1568 4300 E4B3.tmp 104 PID 1568 wrote to memory of 4160 1568 E53F.tmp 105 PID 1568 wrote to memory of 4160 1568 E53F.tmp 105 PID 1568 wrote to memory of 4160 1568 E53F.tmp 105 PID 4160 wrote to memory of 1360 4160 E5BC.tmp 106 PID 4160 wrote to memory of 1360 4160 E5BC.tmp 106 PID 4160 wrote to memory of 1360 4160 E5BC.tmp 106 PID 1360 wrote to memory of 5056 1360 E61A.tmp 107 PID 1360 wrote to memory of 5056 1360 E61A.tmp 107 PID 1360 wrote to memory of 5056 1360 E61A.tmp 107 PID 5056 wrote to memory of 1236 5056 E687.tmp 108 PID 5056 wrote to memory of 1236 5056 E687.tmp 108 PID 5056 wrote to memory of 1236 5056 E687.tmp 108 PID 1236 wrote to memory of 3956 1236 E704.tmp 109 PID 1236 wrote to memory of 3956 1236 E704.tmp 109 PID 1236 wrote to memory of 3956 1236 E704.tmp 109 PID 3956 wrote to memory of 2076 3956 E772.tmp 110 PID 3956 wrote to memory of 2076 3956 E772.tmp 110 PID 3956 wrote to memory of 2076 3956 E772.tmp 110 PID 2076 wrote to memory of 3024 2076 E7C0.tmp 113 PID 2076 wrote to memory of 3024 2076 E7C0.tmp 113 PID 2076 wrote to memory of 3024 2076 E7C0.tmp 113 PID 3024 wrote to memory of 232 3024 E81E.tmp 114 PID 3024 wrote to memory of 232 3024 E81E.tmp 114 PID 3024 wrote to memory of 232 3024 E81E.tmp 114 PID 232 wrote to memory of 1324 232 E88B.tmp 115 PID 232 wrote to memory of 1324 232 E88B.tmp 115 PID 232 wrote to memory of 1324 232 E88B.tmp 115 PID 1324 wrote to memory of 4424 1324 E8E9.tmp 116 PID 1324 wrote to memory of 4424 1324 E8E9.tmp 116 PID 1324 wrote to memory of 4424 1324 E8E9.tmp 116 PID 4424 wrote to memory of 3448 4424 E937.tmp 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\E157.tmp"C:\Users\Admin\AppData\Local\Temp\E157.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\E251.tmp"C:\Users\Admin\AppData\Local\Temp\E251.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\E32C.tmp"C:\Users\Admin\AppData\Local\Temp\E32C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\E61A.tmp"C:\Users\Admin\AppData\Local\Temp\E61A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\E687.tmp"C:\Users\Admin\AppData\Local\Temp\E687.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\E704.tmp"C:\Users\Admin\AppData\Local\Temp\E704.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\E937.tmp"C:\Users\Admin\AppData\Local\Temp\E937.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"23⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"24⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"25⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"26⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"27⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\EB98.tmp"C:\Users\Admin\AppData\Local\Temp\EB98.tmp"28⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"29⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\EC83.tmp"C:\Users\Admin\AppData\Local\Temp\EC83.tmp"30⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"31⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"32⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"33⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\EE38.tmp"C:\Users\Admin\AppData\Local\Temp\EE38.tmp"34⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"35⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"36⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\EF42.tmp"C:\Users\Admin\AppData\Local\Temp\EF42.tmp"37⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"38⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"39⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"40⤵
- Executes dropped EXE
PID:672 -
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"41⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"42⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"43⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"44⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"45⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\F220.tmp"C:\Users\Admin\AppData\Local\Temp\F220.tmp"46⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\F27E.tmp"C:\Users\Admin\AppData\Local\Temp\F27E.tmp"47⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"48⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"49⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\F378.tmp"C:\Users\Admin\AppData\Local\Temp\F378.tmp"50⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"51⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\F433.tmp"C:\Users\Admin\AppData\Local\Temp\F433.tmp"52⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\F491.tmp"C:\Users\Admin\AppData\Local\Temp\F491.tmp"53⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"54⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"55⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"56⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"57⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\F656.tmp"C:\Users\Admin\AppData\Local\Temp\F656.tmp"58⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"59⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"60⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\F770.tmp"C:\Users\Admin\AppData\Local\Temp\F770.tmp"61⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"62⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"63⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\F879.tmp"C:\Users\Admin\AppData\Local\Temp\F879.tmp"64⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"65⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\F935.tmp"C:\Users\Admin\AppData\Local\Temp\F935.tmp"66⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\F992.tmp"C:\Users\Admin\AppData\Local\Temp\F992.tmp"67⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"68⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"69⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"70⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"71⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"72⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"73⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"74⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\FC80.tmp"C:\Users\Admin\AppData\Local\Temp\FC80.tmp"75⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"76⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"77⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"78⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"79⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\FE46.tmp"C:\Users\Admin\AppData\Local\Temp\FE46.tmp"80⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"81⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"82⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"83⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"84⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"85⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"86⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"87⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\114.tmp"C:\Users\Admin\AppData\Local\Temp\114.tmp"88⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"89⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\1D0.tmp"C:\Users\Admin\AppData\Local\Temp\1D0.tmp"90⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\22E.tmp"C:\Users\Admin\AppData\Local\Temp\22E.tmp"91⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"92⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"93⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"94⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\3A5.tmp"C:\Users\Admin\AppData\Local\Temp\3A5.tmp"95⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"96⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\450.tmp"C:\Users\Admin\AppData\Local\Temp\450.tmp"97⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"98⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"99⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"100⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"101⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"102⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\673.tmp"C:\Users\Admin\AppData\Local\Temp\673.tmp"103⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\6D1.tmp"C:\Users\Admin\AppData\Local\Temp\6D1.tmp"104⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"105⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\76D.tmp"C:\Users\Admin\AppData\Local\Temp\76D.tmp"106⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"107⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\80A.tmp"C:\Users\Admin\AppData\Local\Temp\80A.tmp"108⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"109⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"110⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"111⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"112⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\9BF.tmp"C:\Users\Admin\AppData\Local\Temp\9BF.tmp"113⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"114⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"115⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"116⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\B07.tmp"C:\Users\Admin\AppData\Local\Temp\B07.tmp"117⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"118⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"119⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"120⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"121⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"122⤵PID:3580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-