Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 17:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe
-
Size
529KB
-
MD5
9f35217194023cddac7c09f6b40daa81
-
SHA1
a4a99a9f24915188e88b1314bbc0b5b3d3eb8e98
-
SHA256
8be9de73f152212cb189cdd4d2a2819abe18bfe1b77dcec1c780ff8b851a0ff9
-
SHA512
912bb7b88d6ba078196051bd8725dfdd1f15ffef4dcbf6c2da0a0ff52e26164a10a3ee0ee9b9c27536d93667160f44be15d09d694b82ea694d9b5f0287b66ee8
-
SSDEEP
12288:NU5rCOTeijTFD7kxoM//Dr2rz4kTZwlH4Hp:NUQOJjTF8z/4TSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1400 DEF6.tmp 5028 DF83.tmp 2280 DFE0.tmp 4644 E05D.tmp 5036 E0DA.tmp 2336 E138.tmp 2796 E1A5.tmp 1868 E203.tmp 944 E271.tmp 1496 E2CE.tmp 2360 E33C.tmp 3164 E3A9.tmp 3008 E426.tmp 4288 E4A3.tmp 1724 E510.tmp 1504 E57E.tmp 3124 E5FB.tmp 2332 E687.tmp 2832 E704.tmp 2080 E762.tmp 2800 E7EF.tmp 908 E86C.tmp 2088 E8E9.tmp 3436 E966.tmp 2344 E9B4.tmp 2868 EA02.tmp 3056 EA6F.tmp 1332 EACD.tmp 2840 EB4A.tmp 4808 EBA8.tmp 3080 EBF6.tmp 4108 EC44.tmp 4216 ECC1.tmp 2740 ED1F.tmp 4428 EDBB.tmp 5016 EE19.tmp 1020 EE67.tmp 1864 EEC5.tmp 4144 EF13.tmp 2416 EF61.tmp 3092 EFBF.tmp 3156 F00D.tmp 1384 F05B.tmp 2448 F0B9.tmp 4116 F107.tmp 4572 F155.tmp 2492 F1B3.tmp 2108 F211.tmp 4156 F25F.tmp 3064 F2BC.tmp 4896 F31A.tmp 540 F368.tmp 2228 F3B6.tmp 3232 F414.tmp 2052 F462.tmp 412 F4B0.tmp 4276 F4FF.tmp 2908 F55C.tmp 3384 F5AA.tmp 220 F5F9.tmp 3588 F656.tmp 2604 F6A4.tmp 2832 F6F3.tmp 1212 F741.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1020 wrote to memory of 1400 1020 2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe 88 PID 1020 wrote to memory of 1400 1020 2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe 88 PID 1020 wrote to memory of 1400 1020 2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe 88 PID 1400 wrote to memory of 5028 1400 DEF6.tmp 89 PID 1400 wrote to memory of 5028 1400 DEF6.tmp 89 PID 1400 wrote to memory of 5028 1400 DEF6.tmp 89 PID 5028 wrote to memory of 2280 5028 DF83.tmp 90 PID 5028 wrote to memory of 2280 5028 DF83.tmp 90 PID 5028 wrote to memory of 2280 5028 DF83.tmp 90 PID 2280 wrote to memory of 4644 2280 DFE0.tmp 92 PID 2280 wrote to memory of 4644 2280 DFE0.tmp 92 PID 2280 wrote to memory of 4644 2280 DFE0.tmp 92 PID 4644 wrote to memory of 5036 4644 E05D.tmp 94 PID 4644 wrote to memory of 5036 4644 E05D.tmp 94 PID 4644 wrote to memory of 5036 4644 E05D.tmp 94 PID 5036 wrote to memory of 2336 5036 E0DA.tmp 95 PID 5036 wrote to memory of 2336 5036 E0DA.tmp 95 PID 5036 wrote to memory of 2336 5036 E0DA.tmp 95 PID 2336 wrote to memory of 2796 2336 E138.tmp 97 PID 2336 wrote to memory of 2796 2336 E138.tmp 97 PID 2336 wrote to memory of 2796 2336 E138.tmp 97 PID 2796 wrote to memory of 1868 2796 E1A5.tmp 98 PID 2796 wrote to memory of 1868 2796 E1A5.tmp 98 PID 2796 wrote to memory of 1868 2796 E1A5.tmp 98 PID 1868 wrote to memory of 944 1868 E203.tmp 99 PID 1868 wrote to memory of 944 1868 E203.tmp 99 PID 1868 wrote to memory of 944 1868 E203.tmp 99 PID 944 wrote to memory of 1496 944 E271.tmp 100 PID 944 wrote to memory of 1496 944 E271.tmp 100 PID 944 wrote to memory of 1496 944 E271.tmp 100 PID 1496 wrote to memory of 2360 1496 E2CE.tmp 101 PID 1496 wrote to memory of 2360 1496 E2CE.tmp 101 PID 1496 wrote to memory of 2360 1496 E2CE.tmp 101 PID 2360 wrote to memory of 3164 2360 E33C.tmp 102 PID 2360 wrote to memory of 3164 2360 E33C.tmp 102 PID 2360 wrote to memory of 3164 2360 E33C.tmp 102 PID 3164 wrote to memory of 3008 3164 E3A9.tmp 103 PID 3164 wrote to memory of 3008 3164 E3A9.tmp 103 PID 3164 wrote to memory of 3008 3164 E3A9.tmp 103 PID 3008 wrote to memory of 4288 3008 E426.tmp 104 PID 3008 wrote to memory of 4288 3008 E426.tmp 104 PID 3008 wrote to memory of 4288 3008 E426.tmp 104 PID 4288 wrote to memory of 1724 4288 E4A3.tmp 105 PID 4288 wrote to memory of 1724 4288 E4A3.tmp 105 PID 4288 wrote to memory of 1724 4288 E4A3.tmp 105 PID 1724 wrote to memory of 1504 1724 E510.tmp 106 PID 1724 wrote to memory of 1504 1724 E510.tmp 106 PID 1724 wrote to memory of 1504 1724 E510.tmp 106 PID 1504 wrote to memory of 3124 1504 E57E.tmp 107 PID 1504 wrote to memory of 3124 1504 E57E.tmp 107 PID 1504 wrote to memory of 3124 1504 E57E.tmp 107 PID 3124 wrote to memory of 2332 3124 E5FB.tmp 108 PID 3124 wrote to memory of 2332 3124 E5FB.tmp 108 PID 3124 wrote to memory of 2332 3124 E5FB.tmp 108 PID 2332 wrote to memory of 2832 2332 E687.tmp 109 PID 2332 wrote to memory of 2832 2332 E687.tmp 109 PID 2332 wrote to memory of 2832 2332 E687.tmp 109 PID 2832 wrote to memory of 2080 2832 E704.tmp 110 PID 2832 wrote to memory of 2080 2832 E704.tmp 110 PID 2832 wrote to memory of 2080 2832 E704.tmp 110 PID 2080 wrote to memory of 2800 2080 E762.tmp 111 PID 2080 wrote to memory of 2800 2080 E762.tmp 111 PID 2080 wrote to memory of 2800 2080 E762.tmp 111 PID 2800 wrote to memory of 908 2800 E7EF.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_9f35217194023cddac7c09f6b40daa81_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\DF83.tmp"C:\Users\Admin\AppData\Local\Temp\DF83.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\E138.tmp"C:\Users\Admin\AppData\Local\Temp\E138.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\E33C.tmp"C:\Users\Admin\AppData\Local\Temp\E33C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\E687.tmp"C:\Users\Admin\AppData\Local\Temp\E687.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\E704.tmp"C:\Users\Admin\AppData\Local\Temp\E704.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"23⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"24⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"25⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"26⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\EA02.tmp"C:\Users\Admin\AppData\Local\Temp\EA02.tmp"27⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"28⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"29⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"30⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"31⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"32⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"33⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"34⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"35⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"36⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\EE19.tmp"C:\Users\Admin\AppData\Local\Temp\EE19.tmp"37⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\EE67.tmp"C:\Users\Admin\AppData\Local\Temp\EE67.tmp"38⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"39⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\EF13.tmp"C:\Users\Admin\AppData\Local\Temp\EF13.tmp"40⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\EF61.tmp"C:\Users\Admin\AppData\Local\Temp\EF61.tmp"41⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"42⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\F00D.tmp"C:\Users\Admin\AppData\Local\Temp\F00D.tmp"43⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\F05B.tmp"C:\Users\Admin\AppData\Local\Temp\F05B.tmp"44⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"45⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\F107.tmp"C:\Users\Admin\AppData\Local\Temp\F107.tmp"46⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\F155.tmp"C:\Users\Admin\AppData\Local\Temp\F155.tmp"47⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"48⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"49⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\F25F.tmp"C:\Users\Admin\AppData\Local\Temp\F25F.tmp"50⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"51⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"52⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"53⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"54⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"55⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\F462.tmp"C:\Users\Admin\AppData\Local\Temp\F462.tmp"56⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"57⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"58⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\F55C.tmp"C:\Users\Admin\AppData\Local\Temp\F55C.tmp"59⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"60⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"61⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\F656.tmp"C:\Users\Admin\AppData\Local\Temp\F656.tmp"62⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"63⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"64⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\F741.tmp"C:\Users\Admin\AppData\Local\Temp\F741.tmp"65⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\F79E.tmp"C:\Users\Admin\AppData\Local\Temp\F79E.tmp"66⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"67⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\F83B.tmp"C:\Users\Admin\AppData\Local\Temp\F83B.tmp"68⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"69⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"70⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\F954.tmp"C:\Users\Admin\AppData\Local\Temp\F954.tmp"71⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"72⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"73⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"74⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\FACB.tmp"C:\Users\Admin\AppData\Local\Temp\FACB.tmp"75⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\FB19.tmp"C:\Users\Admin\AppData\Local\Temp\FB19.tmp"76⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"77⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"78⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"79⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"80⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"81⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"82⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"83⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"84⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"85⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"86⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"87⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"88⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"89⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"90⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"91⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\97.tmp"C:\Users\Admin\AppData\Local\Temp\97.tmp"92⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\E5.tmp"C:\Users\Admin\AppData\Local\Temp\E5.tmp"93⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"94⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"95⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\1D0.tmp"C:\Users\Admin\AppData\Local\Temp\1D0.tmp"96⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\22E.tmp"C:\Users\Admin\AppData\Local\Temp\22E.tmp"97⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"98⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"99⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\337.tmp"C:\Users\Admin\AppData\Local\Temp\337.tmp"100⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\395.tmp"C:\Users\Admin\AppData\Local\Temp\395.tmp"101⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"102⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"103⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"104⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\4FC.tmp"C:\Users\Admin\AppData\Local\Temp\4FC.tmp"105⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"106⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"107⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\5F6.tmp"C:\Users\Admin\AppData\Local\Temp\5F6.tmp"108⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"109⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"110⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"111⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\75E.tmp"C:\Users\Admin\AppData\Local\Temp\75E.tmp"112⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"113⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\80A.tmp"C:\Users\Admin\AppData\Local\Temp\80A.tmp"114⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"115⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\8B5.tmp"C:\Users\Admin\AppData\Local\Temp\8B5.tmp"116⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"117⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\952.tmp"C:\Users\Admin\AppData\Local\Temp\952.tmp"118⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\9AF.tmp"C:\Users\Admin\AppData\Local\Temp\9AF.tmp"119⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\A0D.tmp"C:\Users\Admin\AppData\Local\Temp\A0D.tmp"120⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"121⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"122⤵PID:452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-