Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 23:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-05_e80ca0164bf12347b3497c0f6ebcf9a2_mafia.exe
Resource
win7-20240705-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-05_e80ca0164bf12347b3497c0f6ebcf9a2_mafia.exe
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
2024-07-05_e80ca0164bf12347b3497c0f6ebcf9a2_mafia.exe
-
Size
487KB
-
MD5
e80ca0164bf12347b3497c0f6ebcf9a2
-
SHA1
5bb41798eaf12bf77f813830714d2fc449856087
-
SHA256
b68c0badd83acccff06f1dde654833e7b194c9128e5d03cd7dfd62ff932600c7
-
SHA512
9ecd13080158350ea138a4b43c0fd85a699892056b7be8cdd530e03d0e9b399c04304a8a4498bb57fcb640bed1d0ea6c3d10bfe9dc5e1ea7fcd12f3019060c9d
-
SSDEEP
12288:yU5rCOTeiNj96jiFXAgxjvp0vDOvgyrWbbZ:yUQOJNjoj6Tp4OdrMb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1912 FDA.tmp 2380 1047.tmp 2424 10A5.tmp 3192 1102.tmp 4108 1160.tmp 1920 11AE.tmp 1448 120C.tmp 5004 1279.tmp 1064 12D7.tmp 3152 1325.tmp 3652 1383.tmp 4708 13D1.tmp 4164 143F.tmp 3528 148D.tmp 4592 14DB.tmp 1552 1529.tmp 4296 1596.tmp 4064 15F4.tmp 668 1661.tmp 4508 16BF.tmp 224 172D.tmp 2596 177B.tmp 856 17C9.tmp 4908 1827.tmp 1844 1894.tmp 976 18E2.tmp 3388 195F.tmp 1628 19BD.tmp 4400 1A1B.tmp 3496 1A69.tmp 3500 1AB7.tmp 2416 1B05.tmp 2028 1B63.tmp 1808 1BB1.tmp 1772 1BFF.tmp 3972 1C4D.tmp 3844 1C9B.tmp 3196 1CF9.tmp 2908 1D47.tmp 4796 1D95.tmp 1868 1DE3.tmp 4156 1E31.tmp 3108 1E8F.tmp 5024 1EED.tmp 4436 1F4B.tmp 4420 1FA8.tmp 3372 1FF7.tmp 1544 2045.tmp 3564 20A2.tmp 2008 2100.tmp 2200 214E.tmp 1836 219C.tmp 2424 21FA.tmp 1420 2248.tmp 2528 2296.tmp 2068 22E5.tmp 1920 2342.tmp 3648 2390.tmp 5092 23DF.tmp 5004 242D.tmp 2632 247B.tmp 416 24C9.tmp 3332 2517.tmp 3124 2565.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3372 wrote to memory of 1912 3372 2024-07-05_e80ca0164bf12347b3497c0f6ebcf9a2_mafia.exe 83 PID 3372 wrote to memory of 1912 3372 2024-07-05_e80ca0164bf12347b3497c0f6ebcf9a2_mafia.exe 83 PID 3372 wrote to memory of 1912 3372 2024-07-05_e80ca0164bf12347b3497c0f6ebcf9a2_mafia.exe 83 PID 1912 wrote to memory of 2380 1912 FDA.tmp 84 PID 1912 wrote to memory of 2380 1912 FDA.tmp 84 PID 1912 wrote to memory of 2380 1912 FDA.tmp 84 PID 2380 wrote to memory of 2424 2380 1047.tmp 86 PID 2380 wrote to memory of 2424 2380 1047.tmp 86 PID 2380 wrote to memory of 2424 2380 1047.tmp 86 PID 2424 wrote to memory of 3192 2424 10A5.tmp 87 PID 2424 wrote to memory of 3192 2424 10A5.tmp 87 PID 2424 wrote to memory of 3192 2424 10A5.tmp 87 PID 3192 wrote to memory of 4108 3192 1102.tmp 88 PID 3192 wrote to memory of 4108 3192 1102.tmp 88 PID 3192 wrote to memory of 4108 3192 1102.tmp 88 PID 4108 wrote to memory of 1920 4108 1160.tmp 89 PID 4108 wrote to memory of 1920 4108 1160.tmp 89 PID 4108 wrote to memory of 1920 4108 1160.tmp 89 PID 1920 wrote to memory of 1448 1920 11AE.tmp 90 PID 1920 wrote to memory of 1448 1920 11AE.tmp 90 PID 1920 wrote to memory of 1448 1920 11AE.tmp 90 PID 1448 wrote to memory of 5004 1448 120C.tmp 91 PID 1448 wrote to memory of 5004 1448 120C.tmp 91 PID 1448 wrote to memory of 5004 1448 120C.tmp 91 PID 5004 wrote to memory of 1064 5004 1279.tmp 92 PID 5004 wrote to memory of 1064 5004 1279.tmp 92 PID 5004 wrote to memory of 1064 5004 1279.tmp 92 PID 1064 wrote to memory of 3152 1064 12D7.tmp 93 PID 1064 wrote to memory of 3152 1064 12D7.tmp 93 PID 1064 wrote to memory of 3152 1064 12D7.tmp 93 PID 3152 wrote to memory of 3652 3152 1325.tmp 94 PID 3152 wrote to memory of 3652 3152 1325.tmp 94 PID 3152 wrote to memory of 3652 3152 1325.tmp 94 PID 3652 wrote to memory of 4708 3652 1383.tmp 95 PID 3652 wrote to memory of 4708 3652 1383.tmp 95 PID 3652 wrote to memory of 4708 3652 1383.tmp 95 PID 4708 wrote to memory of 4164 4708 13D1.tmp 96 PID 4708 wrote to memory of 4164 4708 13D1.tmp 96 PID 4708 wrote to memory of 4164 4708 13D1.tmp 96 PID 4164 wrote to memory of 3528 4164 143F.tmp 97 PID 4164 wrote to memory of 3528 4164 143F.tmp 97 PID 4164 wrote to memory of 3528 4164 143F.tmp 97 PID 3528 wrote to memory of 4592 3528 148D.tmp 98 PID 3528 wrote to memory of 4592 3528 148D.tmp 98 PID 3528 wrote to memory of 4592 3528 148D.tmp 98 PID 4592 wrote to memory of 1552 4592 14DB.tmp 99 PID 4592 wrote to memory of 1552 4592 14DB.tmp 99 PID 4592 wrote to memory of 1552 4592 14DB.tmp 99 PID 1552 wrote to memory of 4296 1552 1529.tmp 100 PID 1552 wrote to memory of 4296 1552 1529.tmp 100 PID 1552 wrote to memory of 4296 1552 1529.tmp 100 PID 4296 wrote to memory of 4064 4296 1596.tmp 101 PID 4296 wrote to memory of 4064 4296 1596.tmp 101 PID 4296 wrote to memory of 4064 4296 1596.tmp 101 PID 4064 wrote to memory of 668 4064 15F4.tmp 102 PID 4064 wrote to memory of 668 4064 15F4.tmp 102 PID 4064 wrote to memory of 668 4064 15F4.tmp 102 PID 668 wrote to memory of 4508 668 1661.tmp 103 PID 668 wrote to memory of 4508 668 1661.tmp 103 PID 668 wrote to memory of 4508 668 1661.tmp 103 PID 4508 wrote to memory of 224 4508 16BF.tmp 104 PID 4508 wrote to memory of 224 4508 16BF.tmp 104 PID 4508 wrote to memory of 224 4508 16BF.tmp 104 PID 224 wrote to memory of 2596 224 172D.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-05_e80ca0164bf12347b3497c0f6ebcf9a2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-05_e80ca0164bf12347b3497c0f6ebcf9a2_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\FDA.tmp"C:\Users\Admin\AppData\Local\Temp\FDA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\10A5.tmp"C:\Users\Admin\AppData\Local\Temp\10A5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\1102.tmp"C:\Users\Admin\AppData\Local\Temp\1102.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\1279.tmp"C:\Users\Admin\AppData\Local\Temp\1279.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\1325.tmp"C:\Users\Admin\AppData\Local\Temp\1325.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\1383.tmp"C:\Users\Admin\AppData\Local\Temp\1383.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\143F.tmp"C:\Users\Admin\AppData\Local\Temp\143F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\148D.tmp"C:\Users\Admin\AppData\Local\Temp\148D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\14DB.tmp"C:\Users\Admin\AppData\Local\Temp\14DB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\1529.tmp"C:\Users\Admin\AppData\Local\Temp\1529.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\1596.tmp"C:\Users\Admin\AppData\Local\Temp\1596.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\1661.tmp"C:\Users\Admin\AppData\Local\Temp\1661.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\16BF.tmp"C:\Users\Admin\AppData\Local\Temp\16BF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\172D.tmp"C:\Users\Admin\AppData\Local\Temp\172D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"23⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"24⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\1827.tmp"C:\Users\Admin\AppData\Local\Temp\1827.tmp"25⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\1894.tmp"C:\Users\Admin\AppData\Local\Temp\1894.tmp"26⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\18E2.tmp"C:\Users\Admin\AppData\Local\Temp\18E2.tmp"27⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\195F.tmp"C:\Users\Admin\AppData\Local\Temp\195F.tmp"28⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\19BD.tmp"C:\Users\Admin\AppData\Local\Temp\19BD.tmp"29⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"30⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"31⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"32⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\1B05.tmp"C:\Users\Admin\AppData\Local\Temp\1B05.tmp"33⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\1B63.tmp"C:\Users\Admin\AppData\Local\Temp\1B63.tmp"34⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"35⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"36⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"37⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"38⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"39⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\1D47.tmp"C:\Users\Admin\AppData\Local\Temp\1D47.tmp"40⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"41⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"42⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\1E31.tmp"C:\Users\Admin\AppData\Local\Temp\1E31.tmp"43⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"44⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\1EED.tmp"C:\Users\Admin\AppData\Local\Temp\1EED.tmp"45⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"46⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"47⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"48⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"49⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"50⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"51⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\214E.tmp"C:\Users\Admin\AppData\Local\Temp\214E.tmp"52⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\219C.tmp"C:\Users\Admin\AppData\Local\Temp\219C.tmp"53⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\21FA.tmp"C:\Users\Admin\AppData\Local\Temp\21FA.tmp"54⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\2248.tmp"C:\Users\Admin\AppData\Local\Temp\2248.tmp"55⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\2296.tmp"C:\Users\Admin\AppData\Local\Temp\2296.tmp"56⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"57⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\2342.tmp"C:\Users\Admin\AppData\Local\Temp\2342.tmp"58⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\2390.tmp"C:\Users\Admin\AppData\Local\Temp\2390.tmp"59⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\23DF.tmp"C:\Users\Admin\AppData\Local\Temp\23DF.tmp"60⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\242D.tmp"C:\Users\Admin\AppData\Local\Temp\242D.tmp"61⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\247B.tmp"C:\Users\Admin\AppData\Local\Temp\247B.tmp"62⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"63⤵
- Executes dropped EXE
PID:416 -
C:\Users\Admin\AppData\Local\Temp\2517.tmp"C:\Users\Admin\AppData\Local\Temp\2517.tmp"64⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"65⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\25B3.tmp"C:\Users\Admin\AppData\Local\Temp\25B3.tmp"66⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\2601.tmp"C:\Users\Admin\AppData\Local\Temp\2601.tmp"67⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\2650.tmp"C:\Users\Admin\AppData\Local\Temp\2650.tmp"68⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"69⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"70⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\273A.tmp"C:\Users\Admin\AppData\Local\Temp\273A.tmp"71⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"72⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\27D6.tmp"C:\Users\Admin\AppData\Local\Temp\27D6.tmp"73⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"74⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\2872.tmp"C:\Users\Admin\AppData\Local\Temp\2872.tmp"75⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\28C1.tmp"C:\Users\Admin\AppData\Local\Temp\28C1.tmp"76⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"77⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"78⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"79⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\2A09.tmp"C:\Users\Admin\AppData\Local\Temp\2A09.tmp"80⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"81⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"82⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"83⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"84⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"85⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\2BED.tmp"C:\Users\Admin\AppData\Local\Temp\2BED.tmp"86⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"87⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"88⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2D06.tmp"C:\Users\Admin\AppData\Local\Temp\2D06.tmp"89⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\2D54.tmp"C:\Users\Admin\AppData\Local\Temp\2D54.tmp"90⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"91⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"92⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"93⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"94⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"95⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"96⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\2F77.tmp"C:\Users\Admin\AppData\Local\Temp\2F77.tmp"97⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"98⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"99⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\3071.tmp"C:\Users\Admin\AppData\Local\Temp\3071.tmp"100⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\30DF.tmp"C:\Users\Admin\AppData\Local\Temp\30DF.tmp"101⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\312D.tmp"C:\Users\Admin\AppData\Local\Temp\312D.tmp"102⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\317B.tmp"C:\Users\Admin\AppData\Local\Temp\317B.tmp"103⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\31C9.tmp"C:\Users\Admin\AppData\Local\Temp\31C9.tmp"104⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\3217.tmp"C:\Users\Admin\AppData\Local\Temp\3217.tmp"105⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\3265.tmp"C:\Users\Admin\AppData\Local\Temp\3265.tmp"106⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\32B3.tmp"C:\Users\Admin\AppData\Local\Temp\32B3.tmp"107⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"108⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"109⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\33AD.tmp"C:\Users\Admin\AppData\Local\Temp\33AD.tmp"110⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"111⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"112⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"113⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"114⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"115⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"116⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"117⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\363E.tmp"C:\Users\Admin\AppData\Local\Temp\363E.tmp"118⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\369B.tmp"C:\Users\Admin\AppData\Local\Temp\369B.tmp"119⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\36F9.tmp"C:\Users\Admin\AppData\Local\Temp\36F9.tmp"120⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\3747.tmp"C:\Users\Admin\AppData\Local\Temp\3747.tmp"121⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\3795.tmp"C:\Users\Admin\AppData\Local\Temp\3795.tmp"122⤵PID:2296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-