Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 20:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-04_feb2c203e09e4c19f7af68eb49527bb6_mafia.exe
Resource
win7-20240611-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-04_feb2c203e09e4c19f7af68eb49527bb6_mafia.exe
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
2024-07-04_feb2c203e09e4c19f7af68eb49527bb6_mafia.exe
-
Size
765KB
-
MD5
feb2c203e09e4c19f7af68eb49527bb6
-
SHA1
47c8a7d44e3dba6ff42fa3a616f8bc1d3a3e1b3e
-
SHA256
07452517c1687e71bb6a3a0f6d0574a1f6ee2e0d5d566fee831d45440edaf26b
-
SHA512
926ad8273583797b19cf8fc06e5e6c844dbb7948695102f59d981a4f23488b91a0c38c5d7ad9f6ffc4e895f4beb41c21f8f5478fcbc14f34753206a5f746e3d5
-
SSDEEP
12288:ZU5rCOTeiD1ycsOy+PcSgq3CYaJuy3ZF5rn5rLOa54U5w5A:ZUQOJDoeyh2ly3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3232 DED7.tmp 4832 DFA2.tmp 3536 E06D.tmp 4228 E167.tmp 4856 E1E4.tmp 3228 E29F.tmp 1436 E33C.tmp 2708 E3B9.tmp 3684 E493.tmp 4692 E501.tmp 956 E59D.tmp 3080 E62A.tmp 8 E6B6.tmp 1600 E772.tmp 3792 E83D.tmp 3212 E8BA.tmp 2080 E975.tmp 4060 E9F2.tmp 2908 EA7F.tmp 1216 EB3B.tmp 1648 EBF6.tmp 3052 EC63.tmp 3244 ED0F.tmp 4984 EDBB.tmp 3432 EE48.tmp 3812 EED4.tmp 4712 EF90.tmp 644 EFFD.tmp 4864 F0D8.tmp 232 F165.tmp 3476 F24F.tmp 5072 F2AD.tmp 2244 F388.tmp 1572 F3F5.tmp 436 F462.tmp 2868 F4C0.tmp 1792 F52D.tmp 2316 F59B.tmp 4728 F608.tmp 1788 F676.tmp 3276 F6C4.tmp 2932 F721.tmp 4196 F78F.tmp 3456 F7DD.tmp 64 F84A.tmp 4968 F8A8.tmp 1048 F906.tmp 2192 F954.tmp 4612 F9B2.tmp 5004 FA00.tmp 5044 FA4E.tmp 4504 FA9C.tmp 4408 FB09.tmp 4384 FB77.tmp 2272 FBE4.tmp 1872 FC52.tmp 3232 FCAF.tmp 2680 FD0D.tmp 512 FD7A.tmp 1500 FDC9.tmp 1568 FE36.tmp 2472 FE94.tmp 1156 FEF1.tmp 2460 FF5F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3724 wrote to memory of 3232 3724 2024-07-04_feb2c203e09e4c19f7af68eb49527bb6_mafia.exe 82 PID 3724 wrote to memory of 3232 3724 2024-07-04_feb2c203e09e4c19f7af68eb49527bb6_mafia.exe 82 PID 3724 wrote to memory of 3232 3724 2024-07-04_feb2c203e09e4c19f7af68eb49527bb6_mafia.exe 82 PID 3232 wrote to memory of 4832 3232 DED7.tmp 83 PID 3232 wrote to memory of 4832 3232 DED7.tmp 83 PID 3232 wrote to memory of 4832 3232 DED7.tmp 83 PID 4832 wrote to memory of 3536 4832 DFA2.tmp 85 PID 4832 wrote to memory of 3536 4832 DFA2.tmp 85 PID 4832 wrote to memory of 3536 4832 DFA2.tmp 85 PID 3536 wrote to memory of 4228 3536 E06D.tmp 86 PID 3536 wrote to memory of 4228 3536 E06D.tmp 86 PID 3536 wrote to memory of 4228 3536 E06D.tmp 86 PID 4228 wrote to memory of 4856 4228 E167.tmp 87 PID 4228 wrote to memory of 4856 4228 E167.tmp 87 PID 4228 wrote to memory of 4856 4228 E167.tmp 87 PID 4856 wrote to memory of 3228 4856 E1E4.tmp 88 PID 4856 wrote to memory of 3228 4856 E1E4.tmp 88 PID 4856 wrote to memory of 3228 4856 E1E4.tmp 88 PID 3228 wrote to memory of 1436 3228 E29F.tmp 89 PID 3228 wrote to memory of 1436 3228 E29F.tmp 89 PID 3228 wrote to memory of 1436 3228 E29F.tmp 89 PID 1436 wrote to memory of 2708 1436 E33C.tmp 90 PID 1436 wrote to memory of 2708 1436 E33C.tmp 90 PID 1436 wrote to memory of 2708 1436 E33C.tmp 90 PID 2708 wrote to memory of 3684 2708 E3B9.tmp 91 PID 2708 wrote to memory of 3684 2708 E3B9.tmp 91 PID 2708 wrote to memory of 3684 2708 E3B9.tmp 91 PID 3684 wrote to memory of 4692 3684 E493.tmp 92 PID 3684 wrote to memory of 4692 3684 E493.tmp 92 PID 3684 wrote to memory of 4692 3684 E493.tmp 92 PID 4692 wrote to memory of 956 4692 E501.tmp 93 PID 4692 wrote to memory of 956 4692 E501.tmp 93 PID 4692 wrote to memory of 956 4692 E501.tmp 93 PID 956 wrote to memory of 3080 956 E59D.tmp 94 PID 956 wrote to memory of 3080 956 E59D.tmp 94 PID 956 wrote to memory of 3080 956 E59D.tmp 94 PID 3080 wrote to memory of 8 3080 E62A.tmp 95 PID 3080 wrote to memory of 8 3080 E62A.tmp 95 PID 3080 wrote to memory of 8 3080 E62A.tmp 95 PID 8 wrote to memory of 1600 8 E6B6.tmp 96 PID 8 wrote to memory of 1600 8 E6B6.tmp 96 PID 8 wrote to memory of 1600 8 E6B6.tmp 96 PID 1600 wrote to memory of 3792 1600 E772.tmp 97 PID 1600 wrote to memory of 3792 1600 E772.tmp 97 PID 1600 wrote to memory of 3792 1600 E772.tmp 97 PID 3792 wrote to memory of 3212 3792 E83D.tmp 98 PID 3792 wrote to memory of 3212 3792 E83D.tmp 98 PID 3792 wrote to memory of 3212 3792 E83D.tmp 98 PID 3212 wrote to memory of 2080 3212 E8BA.tmp 99 PID 3212 wrote to memory of 2080 3212 E8BA.tmp 99 PID 3212 wrote to memory of 2080 3212 E8BA.tmp 99 PID 2080 wrote to memory of 4060 2080 E975.tmp 100 PID 2080 wrote to memory of 4060 2080 E975.tmp 100 PID 2080 wrote to memory of 4060 2080 E975.tmp 100 PID 4060 wrote to memory of 2908 4060 E9F2.tmp 101 PID 4060 wrote to memory of 2908 4060 E9F2.tmp 101 PID 4060 wrote to memory of 2908 4060 E9F2.tmp 101 PID 2908 wrote to memory of 1216 2908 EA7F.tmp 102 PID 2908 wrote to memory of 1216 2908 EA7F.tmp 102 PID 2908 wrote to memory of 1216 2908 EA7F.tmp 102 PID 1216 wrote to memory of 1648 1216 EB3B.tmp 103 PID 1216 wrote to memory of 1648 1216 EB3B.tmp 103 PID 1216 wrote to memory of 1648 1216 EB3B.tmp 103 PID 1648 wrote to memory of 3052 1648 EBF6.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-04_feb2c203e09e4c19f7af68eb49527bb6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-04_feb2c203e09e4c19f7af68eb49527bb6_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\E29F.tmp"C:\Users\Admin\AppData\Local\Temp\E29F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\E33C.tmp"C:\Users\Admin\AppData\Local\Temp\E33C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\E59D.tmp"C:\Users\Admin\AppData\Local\Temp\E59D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\E62A.tmp"C:\Users\Admin\AppData\Local\Temp\E62A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"23⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"24⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"25⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\EE48.tmp"C:\Users\Admin\AppData\Local\Temp\EE48.tmp"26⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\EED4.tmp"C:\Users\Admin\AppData\Local\Temp\EED4.tmp"27⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"28⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"29⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"30⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\F165.tmp"C:\Users\Admin\AppData\Local\Temp\F165.tmp"31⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\F24F.tmp"C:\Users\Admin\AppData\Local\Temp\F24F.tmp"32⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"33⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\F388.tmp"C:\Users\Admin\AppData\Local\Temp\F388.tmp"34⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"35⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\F462.tmp"C:\Users\Admin\AppData\Local\Temp\F462.tmp"36⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"37⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"38⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"39⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\F608.tmp"C:\Users\Admin\AppData\Local\Temp\F608.tmp"40⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"41⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"42⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"43⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"44⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"45⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\F84A.tmp"C:\Users\Admin\AppData\Local\Temp\F84A.tmp"46⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"47⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"48⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\F954.tmp"C:\Users\Admin\AppData\Local\Temp\F954.tmp"49⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"50⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"51⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"52⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"53⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"54⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"55⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\FBE4.tmp"C:\Users\Admin\AppData\Local\Temp\FBE4.tmp"56⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\FC52.tmp"C:\Users\Admin\AppData\Local\Temp\FC52.tmp"57⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"58⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"59⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"60⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"61⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\FE36.tmp"C:\Users\Admin\AppData\Local\Temp\FE36.tmp"62⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\FE94.tmp"C:\Users\Admin\AppData\Local\Temp\FE94.tmp"63⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"64⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"65⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"66⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\2A.tmp"C:\Users\Admin\AppData\Local\Temp\2A.tmp"67⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\88.tmp"C:\Users\Admin\AppData\Local\Temp\88.tmp"68⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\D6.tmp"C:\Users\Admin\AppData\Local\Temp\D6.tmp"69⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\124.tmp"C:\Users\Admin\AppData\Local\Temp\124.tmp"70⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"71⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\1DF.tmp"C:\Users\Admin\AppData\Local\Temp\1DF.tmp"72⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"73⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"74⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\2D9.tmp"C:\Users\Admin\AppData\Local\Temp\2D9.tmp"75⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\337.tmp"C:\Users\Admin\AppData\Local\Temp\337.tmp"76⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\395.tmp"C:\Users\Admin\AppData\Local\Temp\395.tmp"77⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"78⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"79⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"80⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"81⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\56A.tmp"C:\Users\Admin\AppData\Local\Temp\56A.tmp"82⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"83⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"84⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"85⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"86⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"87⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\79C.tmp"C:\Users\Admin\AppData\Local\Temp\79C.tmp"88⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\7FA.tmp"C:\Users\Admin\AppData\Local\Temp\7FA.tmp"89⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"90⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"91⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"92⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"93⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\9BF.tmp"C:\Users\Admin\AppData\Local\Temp\9BF.tmp"94⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\A0D.tmp"C:\Users\Admin\AppData\Local\Temp\A0D.tmp"95⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"96⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"97⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp"98⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"99⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\BE2.tmp"C:\Users\Admin\AppData\Local\Temp\BE2.tmp"100⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"101⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"102⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\CFB.tmp"C:\Users\Admin\AppData\Local\Temp\CFB.tmp"103⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"104⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"105⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"106⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"107⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"108⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"109⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"110⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\FF9.tmp"C:\Users\Admin\AppData\Local\Temp\FF9.tmp"111⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"112⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"113⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\1141.tmp"C:\Users\Admin\AppData\Local\Temp\1141.tmp"114⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\118F.tmp"C:\Users\Admin\AppData\Local\Temp\118F.tmp"115⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"116⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\125A.tmp"C:\Users\Admin\AppData\Local\Temp\125A.tmp"117⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\12A8.tmp"C:\Users\Admin\AppData\Local\Temp\12A8.tmp"118⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"119⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"120⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"121⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\142F.tmp"C:\Users\Admin\AppData\Local\Temp\142F.tmp"122⤵PID:4612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-