Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 09:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-29_dfe99f91ac7e7c1f9fb0da8a1e7bf15f_mafia.exe
Resource
win7-20240215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-29_dfe99f91ac7e7c1f9fb0da8a1e7bf15f_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-29_dfe99f91ac7e7c1f9fb0da8a1e7bf15f_mafia.exe
-
Size
520KB
-
MD5
dfe99f91ac7e7c1f9fb0da8a1e7bf15f
-
SHA1
30d684d7e0ef6ecf0589b8656fcf76894dba7f23
-
SHA256
22a1330251b0547fedb716237f40d0da0c6171366e797fda9f1537e0eb429028
-
SHA512
f3a624ff167ac944e2838ee3f27288bc8a2394c198020c9762cf7ca96c1626cd254016bdce212108cc83d6933138d790a4aec90de298aaa71add8db335be2392
-
SSDEEP
12288:roRXOQjmOycorSdORVFLb/qOPh5a6z28INZ:rogQ9yc6SURVl/qYdqN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2040 E59D.tmp 4324 E649.tmp 4028 E6D6.tmp 3528 E753.tmp 5004 E7DF.tmp 3868 E85C.tmp 444 E8CA.tmp 4852 E937.tmp 2072 EA31.tmp 4164 EAAE.tmp 4728 EB1B.tmp 1268 EB89.tmp 1472 EBE6.tmp 1668 EC44.tmp 4268 ECB2.tmp 4800 ED1F.tmp 464 ED9C.tmp 1572 EE19.tmp 1240 EE86.tmp 3500 EEF4.tmp 3480 EF61.tmp 3144 EFAF.tmp 1492 F00D.tmp 2684 F05B.tmp 1440 F117.tmp 3696 F1A3.tmp 4456 F211.tmp 3360 F26E.tmp 332 F2BC.tmp 5048 F339.tmp 1644 F397.tmp 4684 F414.tmp 4480 F482.tmp 4732 F4EF.tmp 1792 F53D.tmp 1472 F58B.tmp 3088 F5D9.tmp 2192 F627.tmp 4884 F685.tmp 2480 F6D3.tmp 4596 F731.tmp 4112 F77F.tmp 4860 F7DD.tmp 2212 F83B.tmp 2920 F898.tmp 4572 F8F6.tmp 4312 F954.tmp 3776 F9A2.tmp 2040 FA00.tmp 3696 FA5E.tmp 4028 FABB.tmp 1196 FB19.tmp 3360 FB77.tmp 4988 FBD5.tmp 3548 FC23.tmp 2336 FC71.tmp 4652 FCCF.tmp 4128 FD2C.tmp 444 FD8A.tmp 2132 FDE8.tmp 4940 FE46.tmp 4684 FE94.tmp 3524 FEF1.tmp 2616 FF4F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3260 wrote to memory of 2040 3260 2024-05-29_dfe99f91ac7e7c1f9fb0da8a1e7bf15f_mafia.exe 90 PID 3260 wrote to memory of 2040 3260 2024-05-29_dfe99f91ac7e7c1f9fb0da8a1e7bf15f_mafia.exe 90 PID 3260 wrote to memory of 2040 3260 2024-05-29_dfe99f91ac7e7c1f9fb0da8a1e7bf15f_mafia.exe 90 PID 2040 wrote to memory of 4324 2040 E59D.tmp 91 PID 2040 wrote to memory of 4324 2040 E59D.tmp 91 PID 2040 wrote to memory of 4324 2040 E59D.tmp 91 PID 4324 wrote to memory of 4028 4324 E649.tmp 93 PID 4324 wrote to memory of 4028 4324 E649.tmp 93 PID 4324 wrote to memory of 4028 4324 E649.tmp 93 PID 4028 wrote to memory of 3528 4028 E6D6.tmp 94 PID 4028 wrote to memory of 3528 4028 E6D6.tmp 94 PID 4028 wrote to memory of 3528 4028 E6D6.tmp 94 PID 3528 wrote to memory of 5004 3528 E753.tmp 96 PID 3528 wrote to memory of 5004 3528 E753.tmp 96 PID 3528 wrote to memory of 5004 3528 E753.tmp 96 PID 5004 wrote to memory of 3868 5004 E7DF.tmp 98 PID 5004 wrote to memory of 3868 5004 E7DF.tmp 98 PID 5004 wrote to memory of 3868 5004 E7DF.tmp 98 PID 3868 wrote to memory of 444 3868 E85C.tmp 99 PID 3868 wrote to memory of 444 3868 E85C.tmp 99 PID 3868 wrote to memory of 444 3868 E85C.tmp 99 PID 444 wrote to memory of 4852 444 E8CA.tmp 100 PID 444 wrote to memory of 4852 444 E8CA.tmp 100 PID 444 wrote to memory of 4852 444 E8CA.tmp 100 PID 4852 wrote to memory of 2072 4852 E937.tmp 101 PID 4852 wrote to memory of 2072 4852 E937.tmp 101 PID 4852 wrote to memory of 2072 4852 E937.tmp 101 PID 2072 wrote to memory of 4164 2072 EA31.tmp 102 PID 2072 wrote to memory of 4164 2072 EA31.tmp 102 PID 2072 wrote to memory of 4164 2072 EA31.tmp 102 PID 4164 wrote to memory of 4728 4164 EAAE.tmp 103 PID 4164 wrote to memory of 4728 4164 EAAE.tmp 103 PID 4164 wrote to memory of 4728 4164 EAAE.tmp 103 PID 4728 wrote to memory of 1268 4728 EB1B.tmp 104 PID 4728 wrote to memory of 1268 4728 EB1B.tmp 104 PID 4728 wrote to memory of 1268 4728 EB1B.tmp 104 PID 1268 wrote to memory of 1472 1268 EB89.tmp 105 PID 1268 wrote to memory of 1472 1268 EB89.tmp 105 PID 1268 wrote to memory of 1472 1268 EB89.tmp 105 PID 1472 wrote to memory of 1668 1472 EBE6.tmp 106 PID 1472 wrote to memory of 1668 1472 EBE6.tmp 106 PID 1472 wrote to memory of 1668 1472 EBE6.tmp 106 PID 1668 wrote to memory of 4268 1668 EC44.tmp 107 PID 1668 wrote to memory of 4268 1668 EC44.tmp 107 PID 1668 wrote to memory of 4268 1668 EC44.tmp 107 PID 4268 wrote to memory of 4800 4268 ECB2.tmp 108 PID 4268 wrote to memory of 4800 4268 ECB2.tmp 108 PID 4268 wrote to memory of 4800 4268 ECB2.tmp 108 PID 4800 wrote to memory of 464 4800 ED1F.tmp 109 PID 4800 wrote to memory of 464 4800 ED1F.tmp 109 PID 4800 wrote to memory of 464 4800 ED1F.tmp 109 PID 464 wrote to memory of 1572 464 ED9C.tmp 110 PID 464 wrote to memory of 1572 464 ED9C.tmp 110 PID 464 wrote to memory of 1572 464 ED9C.tmp 110 PID 1572 wrote to memory of 1240 1572 EE19.tmp 111 PID 1572 wrote to memory of 1240 1572 EE19.tmp 111 PID 1572 wrote to memory of 1240 1572 EE19.tmp 111 PID 1240 wrote to memory of 3500 1240 EE86.tmp 112 PID 1240 wrote to memory of 3500 1240 EE86.tmp 112 PID 1240 wrote to memory of 3500 1240 EE86.tmp 112 PID 3500 wrote to memory of 3480 3500 EEF4.tmp 114 PID 3500 wrote to memory of 3480 3500 EEF4.tmp 114 PID 3500 wrote to memory of 3480 3500 EEF4.tmp 114 PID 3480 wrote to memory of 3144 3480 EF61.tmp 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_dfe99f91ac7e7c1f9fb0da8a1e7bf15f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_dfe99f91ac7e7c1f9fb0da8a1e7bf15f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\E59D.tmp"C:\Users\Admin\AppData\Local\Temp\E59D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\E937.tmp"C:\Users\Admin\AppData\Local\Temp\E937.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\EA31.tmp"C:\Users\Admin\AppData\Local\Temp\EA31.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\EE19.tmp"C:\Users\Admin\AppData\Local\Temp\EE19.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\EF61.tmp"C:\Users\Admin\AppData\Local\Temp\EF61.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"23⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\F00D.tmp"C:\Users\Admin\AppData\Local\Temp\F00D.tmp"24⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\F05B.tmp"C:\Users\Admin\AppData\Local\Temp\F05B.tmp"25⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"26⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\F117.tmp"C:\Users\Admin\AppData\Local\Temp\F117.tmp"27⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"28⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"29⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\F26E.tmp"C:\Users\Admin\AppData\Local\Temp\F26E.tmp"30⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"31⤵
- Executes dropped EXE
PID:332 -
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"32⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\F397.tmp"C:\Users\Admin\AppData\Local\Temp\F397.tmp"33⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"34⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"35⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"36⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\F53D.tmp"C:\Users\Admin\AppData\Local\Temp\F53D.tmp"37⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"38⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"39⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"40⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"41⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"42⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"43⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"44⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"45⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\F83B.tmp"C:\Users\Admin\AppData\Local\Temp\F83B.tmp"46⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"47⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"48⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\F954.tmp"C:\Users\Admin\AppData\Local\Temp\F954.tmp"49⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"50⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"51⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"52⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\FABB.tmp"C:\Users\Admin\AppData\Local\Temp\FABB.tmp"53⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\FB19.tmp"C:\Users\Admin\AppData\Local\Temp\FB19.tmp"54⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"55⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"56⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"57⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"58⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"59⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"60⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"61⤵
- Executes dropped EXE
PID:444 -
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"62⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\FE46.tmp"C:\Users\Admin\AppData\Local\Temp\FE46.tmp"63⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\FE94.tmp"C:\Users\Admin\AppData\Local\Temp\FE94.tmp"64⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"65⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"66⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"67⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"68⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"69⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\97.tmp"C:\Users\Admin\AppData\Local\Temp\97.tmp"70⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\F5.tmp"C:\Users\Admin\AppData\Local\Temp\F5.tmp"71⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\153.tmp"C:\Users\Admin\AppData\Local\Temp\153.tmp"72⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"73⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\20E.tmp"C:\Users\Admin\AppData\Local\Temp\20E.tmp"74⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"75⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"76⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"77⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"78⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\3E3.tmp"C:\Users\Admin\AppData\Local\Temp\3E3.tmp"79⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"80⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"81⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"82⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\56A.tmp"C:\Users\Admin\AppData\Local\Temp\56A.tmp"83⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\5C7.tmp"C:\Users\Admin\AppData\Local\Temp\5C7.tmp"84⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\625.tmp"C:\Users\Admin\AppData\Local\Temp\625.tmp"85⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"86⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\6E1.tmp"C:\Users\Admin\AppData\Local\Temp\6E1.tmp"87⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"88⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\79C.tmp"C:\Users\Admin\AppData\Local\Temp\79C.tmp"89⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\7FA.tmp"C:\Users\Admin\AppData\Local\Temp\7FA.tmp"90⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"91⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\8B5.tmp"C:\Users\Admin\AppData\Local\Temp\8B5.tmp"92⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\913.tmp"C:\Users\Admin\AppData\Local\Temp\913.tmp"93⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"94⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\9BF.tmp"C:\Users\Admin\AppData\Local\Temp\9BF.tmp"95⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"96⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"97⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"98⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp"99⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\B75.tmp"C:\Users\Admin\AppData\Local\Temp\B75.tmp"100⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\BD2.tmp"C:\Users\Admin\AppData\Local\Temp\BD2.tmp"101⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\C20.tmp"C:\Users\Admin\AppData\Local\Temp\C20.tmp"102⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"103⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"104⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"105⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"106⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"107⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"108⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"109⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"110⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\F2E.tmp"C:\Users\Admin\AppData\Local\Temp\F2E.tmp"111⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"112⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\FDA.tmp"C:\Users\Admin\AppData\Local\Temp\FDA.tmp"113⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\1028.tmp"C:\Users\Admin\AppData\Local\Temp\1028.tmp"114⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"115⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"116⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"117⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"118⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\11BE.tmp"C:\Users\Admin\AppData\Local\Temp\11BE.tmp"119⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"120⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\126A.tmp"C:\Users\Admin\AppData\Local\Temp\126A.tmp"121⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\12B8.tmp"C:\Users\Admin\AppData\Local\Temp\12B8.tmp"122⤵PID:2132
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-