Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06/06/2024, 06:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-06_7e9d6daad30f62f9f94645b35c1a6555_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-06_7e9d6daad30f62f9f94645b35c1a6555_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-06_7e9d6daad30f62f9f94645b35c1a6555_mafia.exe
-
Size
536KB
-
MD5
7e9d6daad30f62f9f94645b35c1a6555
-
SHA1
f23d5e9d92c5f20ac6657e1de27ebeb5d07ba94c
-
SHA256
53b226177b50ff1ac2f0ea7edb9a5eb856ef5a61d88db765e7f216ef9a8f6541
-
SHA512
16678b8fa96ed32c69cf04e9d3bddec951710b4ea49e5bc3981868cd82347789289283ca60082128467a632f72da97e84b9f4cbcfa47566b8193866c0b529590
-
SSDEEP
12288:wU5rCOTeiUNB4sWyotT4KfeEDe8KiZsb6n+gIZxVJ0ZT9:wUQOJUHBxotT4tP8dZsG+gIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2024 D0EC.tmp 624 D198.tmp 2876 D244.tmp 3444 D2F0.tmp 1604 D39C.tmp 4604 D476.tmp 1816 D542.tmp 2928 D5DE.tmp 3100 D62C.tmp 3052 D67A.tmp 1640 D6C8.tmp 4688 D726.tmp 2368 D83F.tmp 3604 D8EB.tmp 1620 D939.tmp 4992 DA43.tmp 864 DA91.tmp 1360 DC37.tmp 4996 DC95.tmp 4684 DD60.tmp 3140 DDBD.tmp 4692 DE0C.tmp 2408 DE69.tmp 1316 DEC7.tmp 4552 DF54.tmp 3444 DFB1.tmp 4068 E01F.tmp 2348 E0BB.tmp 2364 E119.tmp 1848 E177.tmp 548 E1E4.tmp 4400 E261.tmp 1480 E2CE.tmp 364 E36B.tmp 864 E3B9.tmp 1580 E407.tmp 2208 E465.tmp 3140 E4F1.tmp 4692 E53F.tmp 384 E59D.tmp 4916 E5EB.tmp 2360 E678.tmp 3192 E6C6.tmp 3008 E714.tmp 1456 E791.tmp 2348 E7DF.tmp 4764 E82D.tmp 4044 E88B.tmp 548 E8F8.tmp 1468 E956.tmp 3392 E9A4.tmp 2228 E9F2.tmp 2708 EA41.tmp 4472 EA9E.tmp 1536 EAEC.tmp 4684 EB3B.tmp 4580 EB89.tmp 4884 EBD7.tmp 4452 EC73.tmp 2504 ECC1.tmp 3748 ED00.tmp 3628 ED4E.tmp 2360 ED9C.tmp 4604 EDEA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1132 wrote to memory of 2024 1132 2024-06-06_7e9d6daad30f62f9f94645b35c1a6555_mafia.exe 92 PID 1132 wrote to memory of 2024 1132 2024-06-06_7e9d6daad30f62f9f94645b35c1a6555_mafia.exe 92 PID 1132 wrote to memory of 2024 1132 2024-06-06_7e9d6daad30f62f9f94645b35c1a6555_mafia.exe 92 PID 2024 wrote to memory of 624 2024 D0EC.tmp 95 PID 2024 wrote to memory of 624 2024 D0EC.tmp 95 PID 2024 wrote to memory of 624 2024 D0EC.tmp 95 PID 624 wrote to memory of 2876 624 D198.tmp 96 PID 624 wrote to memory of 2876 624 D198.tmp 96 PID 624 wrote to memory of 2876 624 D198.tmp 96 PID 2876 wrote to memory of 3444 2876 D244.tmp 124 PID 2876 wrote to memory of 3444 2876 D244.tmp 124 PID 2876 wrote to memory of 3444 2876 D244.tmp 124 PID 3444 wrote to memory of 1604 3444 D2F0.tmp 98 PID 3444 wrote to memory of 1604 3444 D2F0.tmp 98 PID 3444 wrote to memory of 1604 3444 D2F0.tmp 98 PID 1604 wrote to memory of 4604 1604 D39C.tmp 169 PID 1604 wrote to memory of 4604 1604 D39C.tmp 169 PID 1604 wrote to memory of 4604 1604 D39C.tmp 169 PID 4604 wrote to memory of 1816 4604 D476.tmp 101 PID 4604 wrote to memory of 1816 4604 D476.tmp 101 PID 4604 wrote to memory of 1816 4604 D476.tmp 101 PID 1816 wrote to memory of 2928 1816 D542.tmp 103 PID 1816 wrote to memory of 2928 1816 D542.tmp 103 PID 1816 wrote to memory of 2928 1816 D542.tmp 103 PID 2928 wrote to memory of 3100 2928 D5DE.tmp 104 PID 2928 wrote to memory of 3100 2928 D5DE.tmp 104 PID 2928 wrote to memory of 3100 2928 D5DE.tmp 104 PID 3100 wrote to memory of 3052 3100 D62C.tmp 170 PID 3100 wrote to memory of 3052 3100 D62C.tmp 170 PID 3100 wrote to memory of 3052 3100 D62C.tmp 170 PID 3052 wrote to memory of 1640 3052 D67A.tmp 107 PID 3052 wrote to memory of 1640 3052 D67A.tmp 107 PID 3052 wrote to memory of 1640 3052 D67A.tmp 107 PID 1640 wrote to memory of 4688 1640 D6C8.tmp 108 PID 1640 wrote to memory of 4688 1640 D6C8.tmp 108 PID 1640 wrote to memory of 4688 1640 D6C8.tmp 108 PID 4688 wrote to memory of 2368 4688 D726.tmp 109 PID 4688 wrote to memory of 2368 4688 D726.tmp 109 PID 4688 wrote to memory of 2368 4688 D726.tmp 109 PID 2368 wrote to memory of 3604 2368 D83F.tmp 110 PID 2368 wrote to memory of 3604 2368 D83F.tmp 110 PID 2368 wrote to memory of 3604 2368 D83F.tmp 110 PID 3604 wrote to memory of 1620 3604 D8EB.tmp 111 PID 3604 wrote to memory of 1620 3604 D8EB.tmp 111 PID 3604 wrote to memory of 1620 3604 D8EB.tmp 111 PID 1620 wrote to memory of 4992 1620 D939.tmp 112 PID 1620 wrote to memory of 4992 1620 D939.tmp 112 PID 1620 wrote to memory of 4992 1620 D939.tmp 112 PID 4992 wrote to memory of 864 4992 DA43.tmp 136 PID 4992 wrote to memory of 864 4992 DA43.tmp 136 PID 4992 wrote to memory of 864 4992 DA43.tmp 136 PID 864 wrote to memory of 1360 864 DA91.tmp 114 PID 864 wrote to memory of 1360 864 DA91.tmp 114 PID 864 wrote to memory of 1360 864 DA91.tmp 114 PID 1360 wrote to memory of 4996 1360 DC37.tmp 115 PID 1360 wrote to memory of 4996 1360 DC37.tmp 115 PID 1360 wrote to memory of 4996 1360 DC37.tmp 115 PID 4996 wrote to memory of 4684 4996 DC95.tmp 159 PID 4996 wrote to memory of 4684 4996 DC95.tmp 159 PID 4996 wrote to memory of 4684 4996 DC95.tmp 159 PID 4684 wrote to memory of 3140 4684 DD60.tmp 119 PID 4684 wrote to memory of 3140 4684 DD60.tmp 119 PID 4684 wrote to memory of 3140 4684 DD60.tmp 119 PID 3140 wrote to memory of 4692 3140 DDBD.tmp 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_7e9d6daad30f62f9f94645b35c1a6555_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_7e9d6daad30f62f9f94645b35c1a6555_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\D244.tmp"C:\Users\Admin\AppData\Local\Temp\D244.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\D476.tmp"C:\Users\Admin\AppData\Local\Temp\D476.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\D67A.tmp"C:\Users\Admin\AppData\Local\Temp\D67A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\D726.tmp"C:\Users\Admin\AppData\Local\Temp\D726.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\D83F.tmp"C:\Users\Admin\AppData\Local\Temp\D83F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\DA43.tmp"C:\Users\Admin\AppData\Local\Temp\DA43.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\DA91.tmp"C:\Users\Admin\AppData\Local\Temp\DA91.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\DC37.tmp"C:\Users\Admin\AppData\Local\Temp\DC37.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\DC95.tmp"C:\Users\Admin\AppData\Local\Temp\DC95.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\DD60.tmp"C:\Users\Admin\AppData\Local\Temp\DD60.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"23⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\DE69.tmp"C:\Users\Admin\AppData\Local\Temp\DE69.tmp"24⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"25⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"26⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"27⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\E01F.tmp"C:\Users\Admin\AppData\Local\Temp\E01F.tmp"28⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"29⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\E119.tmp"C:\Users\Admin\AppData\Local\Temp\E119.tmp"30⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"31⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"32⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"33⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"34⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"35⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"36⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\E407.tmp"C:\Users\Admin\AppData\Local\Temp\E407.tmp"37⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"38⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"39⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"40⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\E59D.tmp"C:\Users\Admin\AppData\Local\Temp\E59D.tmp"41⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"42⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"43⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"44⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"45⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"46⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"47⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"48⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"49⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"50⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"51⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"52⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"53⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\EA41.tmp"C:\Users\Admin\AppData\Local\Temp\EA41.tmp"54⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"55⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"56⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"57⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"58⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"59⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\EC25.tmp"C:\Users\Admin\AppData\Local\Temp\EC25.tmp"60⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\EC73.tmp"C:\Users\Admin\AppData\Local\Temp\EC73.tmp"61⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"62⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\ED00.tmp"C:\Users\Admin\AppData\Local\Temp\ED00.tmp"63⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"64⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"65⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"66⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\EE38.tmp"C:\Users\Admin\AppData\Local\Temp\EE38.tmp"67⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"68⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\EF23.tmp"C:\Users\Admin\AppData\Local\Temp\EF23.tmp"69⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"70⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"71⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"72⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\F136.tmp"C:\Users\Admin\AppData\Local\Temp\F136.tmp"73⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\F194.tmp"C:\Users\Admin\AppData\Local\Temp\F194.tmp"74⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\F201.tmp"C:\Users\Admin\AppData\Local\Temp\F201.tmp"75⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\F29D.tmp"C:\Users\Admin\AppData\Local\Temp\F29D.tmp"76⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"77⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\F359.tmp"C:\Users\Admin\AppData\Local\Temp\F359.tmp"78⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"79⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"80⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"81⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"82⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"83⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"84⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"85⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\F770.tmp"C:\Users\Admin\AppData\Local\Temp\F770.tmp"86⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"87⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"88⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\F84A.tmp"C:\Users\Admin\AppData\Local\Temp\F84A.tmp"89⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"90⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"91⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"92⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"93⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"94⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"95⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"96⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\FADB.tmp"C:\Users\Admin\AppData\Local\Temp\FADB.tmp"97⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\FB29.tmp"C:\Users\Admin\AppData\Local\Temp\FB29.tmp"98⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"99⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"100⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"101⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"102⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"103⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"104⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"105⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"106⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"107⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"108⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"109⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"110⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"111⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"112⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"113⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"114⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"115⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\E5.tmp"C:\Users\Admin\AppData\Local\Temp\E5.tmp"116⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"117⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"118⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\1D0.tmp"C:\Users\Admin\AppData\Local\Temp\1D0.tmp"119⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\22E.tmp"C:\Users\Admin\AppData\Local\Temp\22E.tmp"120⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"121⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"122⤵PID:3836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-