Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 07:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-05_8880d5431bff6cfdf4cb83187d5dca23_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-05_8880d5431bff6cfdf4cb83187d5dca23_mafia.exe
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
2024-07-05_8880d5431bff6cfdf4cb83187d5dca23_mafia.exe
-
Size
530KB
-
MD5
8880d5431bff6cfdf4cb83187d5dca23
-
SHA1
ab2ceb71992ff0ce0244bafeae96fbdb174b100b
-
SHA256
fd04d0c6a672d02e1891231dbb1c6fe7315485d220cf85c2820937de64d713fd
-
SHA512
68dc9c8c335621250017cfc36fba3cf772d09b51c0d2a33d21c18d0d61efa6c6eb95e268c717bdfb4397bd379c0c075fa0d8d54f235bf316aa9e0fb0154f86e9
-
SSDEEP
12288:AU5rCOTeiobQjt7jKHoyYvV93x+PrgqXK/M7ayENZulFVg0M1:AUQOJobQjthP3kPrjXK/QNENclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2252 CB20.tmp 1164 CBAC.tmp 4968 CC29.tmp 4596 CCE5.tmp 640 CD62.tmp 2208 CDCF.tmp 2984 CE2D.tmp 1648 CE9A.tmp 1780 CF27.tmp 4300 CFA4.tmp 2456 D031.tmp 2136 D09E.tmp 2356 D13A.tmp 1932 D1A8.tmp 2856 D244.tmp 2808 D2D1.tmp 1220 D35D.tmp 2016 D3CB.tmp 4724 D438.tmp 564 D496.tmp 1864 D513.tmp 4404 D59F.tmp 1816 D63C.tmp 1312 D6D8.tmp 4144 D755.tmp 3852 D7D2.tmp 5108 D830.tmp 3340 D8CC.tmp 3392 D968.tmp 3332 D9C6.tmp 4460 DA43.tmp 2340 DAC0.tmp 4952 DB2D.tmp 1936 DB8B.tmp 316 DBE9.tmp 3216 DC46.tmp 4204 DCA4.tmp 2012 DD02.tmp 2364 DD60.tmp 3472 DDAE.tmp 680 DDFC.tmp 3520 DE5A.tmp 4660 DEA8.tmp 2796 DF06.tmp 3548 DF54.tmp 3488 DFB1.tmp 864 E00F.tmp 3988 E06D.tmp 4568 E0CB.tmp 5100 E128.tmp 5056 E186.tmp 2596 E1E4.tmp 4452 E232.tmp 3928 E280.tmp 4368 E2CE.tmp 3092 E31C.tmp 2068 E37A.tmp 4480 E3E8.tmp 1716 E445.tmp 2252 E4B3.tmp 4496 E501.tmp 3080 E55F.tmp 3448 E5BC.tmp 3088 E61A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2140 wrote to memory of 2252 2140 2024-07-05_8880d5431bff6cfdf4cb83187d5dca23_mafia.exe 83 PID 2140 wrote to memory of 2252 2140 2024-07-05_8880d5431bff6cfdf4cb83187d5dca23_mafia.exe 83 PID 2140 wrote to memory of 2252 2140 2024-07-05_8880d5431bff6cfdf4cb83187d5dca23_mafia.exe 83 PID 2252 wrote to memory of 1164 2252 CB20.tmp 84 PID 2252 wrote to memory of 1164 2252 CB20.tmp 84 PID 2252 wrote to memory of 1164 2252 CB20.tmp 84 PID 1164 wrote to memory of 4968 1164 CBAC.tmp 86 PID 1164 wrote to memory of 4968 1164 CBAC.tmp 86 PID 1164 wrote to memory of 4968 1164 CBAC.tmp 86 PID 4968 wrote to memory of 4596 4968 CC29.tmp 87 PID 4968 wrote to memory of 4596 4968 CC29.tmp 87 PID 4968 wrote to memory of 4596 4968 CC29.tmp 87 PID 4596 wrote to memory of 640 4596 CCE5.tmp 88 PID 4596 wrote to memory of 640 4596 CCE5.tmp 88 PID 4596 wrote to memory of 640 4596 CCE5.tmp 88 PID 640 wrote to memory of 2208 640 CD62.tmp 89 PID 640 wrote to memory of 2208 640 CD62.tmp 89 PID 640 wrote to memory of 2208 640 CD62.tmp 89 PID 2208 wrote to memory of 2984 2208 CDCF.tmp 90 PID 2208 wrote to memory of 2984 2208 CDCF.tmp 90 PID 2208 wrote to memory of 2984 2208 CDCF.tmp 90 PID 2984 wrote to memory of 1648 2984 CE2D.tmp 91 PID 2984 wrote to memory of 1648 2984 CE2D.tmp 91 PID 2984 wrote to memory of 1648 2984 CE2D.tmp 91 PID 1648 wrote to memory of 1780 1648 CE9A.tmp 92 PID 1648 wrote to memory of 1780 1648 CE9A.tmp 92 PID 1648 wrote to memory of 1780 1648 CE9A.tmp 92 PID 1780 wrote to memory of 4300 1780 CF27.tmp 93 PID 1780 wrote to memory of 4300 1780 CF27.tmp 93 PID 1780 wrote to memory of 4300 1780 CF27.tmp 93 PID 4300 wrote to memory of 2456 4300 CFA4.tmp 94 PID 4300 wrote to memory of 2456 4300 CFA4.tmp 94 PID 4300 wrote to memory of 2456 4300 CFA4.tmp 94 PID 2456 wrote to memory of 2136 2456 D031.tmp 95 PID 2456 wrote to memory of 2136 2456 D031.tmp 95 PID 2456 wrote to memory of 2136 2456 D031.tmp 95 PID 2136 wrote to memory of 2356 2136 D09E.tmp 96 PID 2136 wrote to memory of 2356 2136 D09E.tmp 96 PID 2136 wrote to memory of 2356 2136 D09E.tmp 96 PID 2356 wrote to memory of 1932 2356 D13A.tmp 97 PID 2356 wrote to memory of 1932 2356 D13A.tmp 97 PID 2356 wrote to memory of 1932 2356 D13A.tmp 97 PID 1932 wrote to memory of 2856 1932 D1A8.tmp 98 PID 1932 wrote to memory of 2856 1932 D1A8.tmp 98 PID 1932 wrote to memory of 2856 1932 D1A8.tmp 98 PID 2856 wrote to memory of 2808 2856 D244.tmp 99 PID 2856 wrote to memory of 2808 2856 D244.tmp 99 PID 2856 wrote to memory of 2808 2856 D244.tmp 99 PID 2808 wrote to memory of 1220 2808 D2D1.tmp 100 PID 2808 wrote to memory of 1220 2808 D2D1.tmp 100 PID 2808 wrote to memory of 1220 2808 D2D1.tmp 100 PID 1220 wrote to memory of 2016 1220 D35D.tmp 101 PID 1220 wrote to memory of 2016 1220 D35D.tmp 101 PID 1220 wrote to memory of 2016 1220 D35D.tmp 101 PID 2016 wrote to memory of 4724 2016 D3CB.tmp 102 PID 2016 wrote to memory of 4724 2016 D3CB.tmp 102 PID 2016 wrote to memory of 4724 2016 D3CB.tmp 102 PID 4724 wrote to memory of 564 4724 D438.tmp 103 PID 4724 wrote to memory of 564 4724 D438.tmp 103 PID 4724 wrote to memory of 564 4724 D438.tmp 103 PID 564 wrote to memory of 1864 564 D496.tmp 104 PID 564 wrote to memory of 1864 564 D496.tmp 104 PID 564 wrote to memory of 1864 564 D496.tmp 104 PID 1864 wrote to memory of 4404 1864 D513.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-05_8880d5431bff6cfdf4cb83187d5dca23_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-05_8880d5431bff6cfdf4cb83187d5dca23_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"C:\Users\Admin\AppData\Local\Temp\D1A8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\D244.tmp"C:\Users\Admin\AppData\Local\Temp\D244.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\D35D.tmp"C:\Users\Admin\AppData\Local\Temp\D35D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\D496.tmp"C:\Users\Admin\AppData\Local\Temp\D496.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\D513.tmp"C:\Users\Admin\AppData\Local\Temp\D513.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"23⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\D63C.tmp"C:\Users\Admin\AppData\Local\Temp\D63C.tmp"24⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"25⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\D755.tmp"C:\Users\Admin\AppData\Local\Temp\D755.tmp"26⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"27⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\D830.tmp"C:\Users\Admin\AppData\Local\Temp\D830.tmp"28⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"29⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"30⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"31⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\DA43.tmp"C:\Users\Admin\AppData\Local\Temp\DA43.tmp"32⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"33⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"C:\Users\Admin\AppData\Local\Temp\DB2D.tmp"34⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"35⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"36⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\DC46.tmp"C:\Users\Admin\AppData\Local\Temp\DC46.tmp"37⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"38⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"39⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\DD60.tmp"C:\Users\Admin\AppData\Local\Temp\DD60.tmp"40⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"41⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"42⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"43⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"44⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\DF06.tmp"C:\Users\Admin\AppData\Local\Temp\DF06.tmp"45⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"46⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"47⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\E00F.tmp"C:\Users\Admin\AppData\Local\Temp\E00F.tmp"48⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"49⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"50⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\E128.tmp"C:\Users\Admin\AppData\Local\Temp\E128.tmp"51⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\E186.tmp"C:\Users\Admin\AppData\Local\Temp\E186.tmp"52⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"53⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"54⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"55⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"56⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\E31C.tmp"C:\Users\Admin\AppData\Local\Temp\E31C.tmp"57⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"58⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"59⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\E445.tmp"C:\Users\Admin\AppData\Local\Temp\E445.tmp"60⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"61⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"62⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"63⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"64⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\E61A.tmp"C:\Users\Admin\AppData\Local\Temp\E61A.tmp"65⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\E668.tmp"C:\Users\Admin\AppData\Local\Temp\E668.tmp"66⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"67⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"68⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"69⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"70⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"71⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"72⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"73⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\E937.tmp"C:\Users\Admin\AppData\Local\Temp\E937.tmp"74⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"75⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\EA02.tmp"C:\Users\Admin\AppData\Local\Temp\EA02.tmp"76⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"77⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"78⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"79⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\EB98.tmp"C:\Users\Admin\AppData\Local\Temp\EB98.tmp"80⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"81⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"82⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"83⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"84⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"85⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"86⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\EE38.tmp"C:\Users\Admin\AppData\Local\Temp\EE38.tmp"87⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"88⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\EF13.tmp"C:\Users\Admin\AppData\Local\Temp\EF13.tmp"89⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\EF80.tmp"C:\Users\Admin\AppData\Local\Temp\EF80.tmp"90⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"91⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"92⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\F0A9.tmp"C:\Users\Admin\AppData\Local\Temp\F0A9.tmp"93⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"94⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\F155.tmp"C:\Users\Admin\AppData\Local\Temp\F155.tmp"95⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"96⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"97⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\F27E.tmp"C:\Users\Admin\AppData\Local\Temp\F27E.tmp"98⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"99⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"100⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"101⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"102⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\F462.tmp"C:\Users\Admin\AppData\Local\Temp\F462.tmp"103⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"104⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\F50E.tmp"C:\Users\Admin\AppData\Local\Temp\F50E.tmp"105⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\F56C.tmp"C:\Users\Admin\AppData\Local\Temp\F56C.tmp"106⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"107⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\F637.tmp"C:\Users\Admin\AppData\Local\Temp\F637.tmp"108⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"109⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"110⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\F760.tmp"C:\Users\Admin\AppData\Local\Temp\F760.tmp"111⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"112⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"113⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"114⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"115⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"116⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"117⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"118⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"119⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\FACB.tmp"C:\Users\Admin\AppData\Local\Temp\FACB.tmp"120⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"121⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"122⤵PID:3836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-