Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11-07-2024 05:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-11_9ece7eca226ebdfe3def315f267770a0_mafia.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-11_9ece7eca226ebdfe3def315f267770a0_mafia.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-11_9ece7eca226ebdfe3def315f267770a0_mafia.exe
-
Size
536KB
-
MD5
9ece7eca226ebdfe3def315f267770a0
-
SHA1
0c87feebce661c33890b3d462d6658959e6de03c
-
SHA256
f9e58f2920e4d349700079716cf06514401c7b13119b919b9d0970034b758005
-
SHA512
9eb4fd9b62edf2415958d8a93cd8a331b767bbcdf013c0df479872109e0a1523f97756984262395766676fccf0d62a73e37a5d1678efd0fcfa8eb4d5bba2ef75
-
SSDEEP
12288:wU5rCOTeiUmvd1u4GCqi3YZn4aihS1VY8kJn/fZLdU7IZxVJ0ZT9:wUQOJUed16iXazqJn/fZLdU7IRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5112 CE2D.tmp 2232 CF17.tmp 1480 D002.tmp 4496 D0CD.tmp 3860 D179.tmp 1648 D215.tmp 1604 D2D1.tmp 1424 D37C.tmp 4752 D419.tmp 1376 D496.tmp 912 D542.tmp 516 D5CE.tmp 4372 D6A9.tmp 1728 D736.tmp 4720 D7C2.tmp 3304 D88D.tmp 1460 D90A.tmp 3432 D9A7.tmp 4220 DA24.tmp 1632 DAB0.tmp 884 DB5C.tmp 2604 DC27.tmp 3400 DCD3.tmp 4316 DD50.tmp 1288 DDCD.tmp 4912 DE98.tmp 2804 DF25.tmp 1988 DFB1.tmp 1996 E07D.tmp 1108 E119.tmp 2816 E186.tmp 3296 E232.tmp 3356 E2BF.tmp 3476 E31C.tmp 4528 E37A.tmp 4396 E3E8.tmp 2392 E455.tmp 3660 E4B3.tmp 4424 E510.tmp 4444 E57E.tmp 5112 E5FB.tmp 2108 E659.tmp 4624 E6C6.tmp 4404 E724.tmp 1936 E781.tmp 1992 E7EF.tmp 1800 E87B.tmp 1696 E8E9.tmp 1408 E937.tmp 1468 E985.tmp 1564 E9D3.tmp 3896 EA21.tmp 4412 EA6F.tmp 4392 EABE.tmp 2380 EB0C.tmp 2696 EB5A.tmp 3424 EBB8.tmp 964 EC06.tmp 4224 EC63.tmp 4720 ECB2.tmp 3088 ED0F.tmp 1460 ED5D.tmp 552 EDAC.tmp 2440 EDFA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 5112 2388 2024-07-11_9ece7eca226ebdfe3def315f267770a0_mafia.exe 83 PID 2388 wrote to memory of 5112 2388 2024-07-11_9ece7eca226ebdfe3def315f267770a0_mafia.exe 83 PID 2388 wrote to memory of 5112 2388 2024-07-11_9ece7eca226ebdfe3def315f267770a0_mafia.exe 83 PID 5112 wrote to memory of 2232 5112 CE2D.tmp 87 PID 5112 wrote to memory of 2232 5112 CE2D.tmp 87 PID 5112 wrote to memory of 2232 5112 CE2D.tmp 87 PID 2232 wrote to memory of 1480 2232 CF17.tmp 88 PID 2232 wrote to memory of 1480 2232 CF17.tmp 88 PID 2232 wrote to memory of 1480 2232 CF17.tmp 88 PID 1480 wrote to memory of 4496 1480 D002.tmp 89 PID 1480 wrote to memory of 4496 1480 D002.tmp 89 PID 1480 wrote to memory of 4496 1480 D002.tmp 89 PID 4496 wrote to memory of 3860 4496 D0CD.tmp 90 PID 4496 wrote to memory of 3860 4496 D0CD.tmp 90 PID 4496 wrote to memory of 3860 4496 D0CD.tmp 90 PID 3860 wrote to memory of 1648 3860 D179.tmp 91 PID 3860 wrote to memory of 1648 3860 D179.tmp 91 PID 3860 wrote to memory of 1648 3860 D179.tmp 91 PID 1648 wrote to memory of 1604 1648 D215.tmp 92 PID 1648 wrote to memory of 1604 1648 D215.tmp 92 PID 1648 wrote to memory of 1604 1648 D215.tmp 92 PID 1604 wrote to memory of 1424 1604 D2D1.tmp 93 PID 1604 wrote to memory of 1424 1604 D2D1.tmp 93 PID 1604 wrote to memory of 1424 1604 D2D1.tmp 93 PID 1424 wrote to memory of 4752 1424 D37C.tmp 94 PID 1424 wrote to memory of 4752 1424 D37C.tmp 94 PID 1424 wrote to memory of 4752 1424 D37C.tmp 94 PID 4752 wrote to memory of 1376 4752 D419.tmp 95 PID 4752 wrote to memory of 1376 4752 D419.tmp 95 PID 4752 wrote to memory of 1376 4752 D419.tmp 95 PID 1376 wrote to memory of 912 1376 D496.tmp 96 PID 1376 wrote to memory of 912 1376 D496.tmp 96 PID 1376 wrote to memory of 912 1376 D496.tmp 96 PID 912 wrote to memory of 516 912 D542.tmp 97 PID 912 wrote to memory of 516 912 D542.tmp 97 PID 912 wrote to memory of 516 912 D542.tmp 97 PID 516 wrote to memory of 4372 516 D5CE.tmp 98 PID 516 wrote to memory of 4372 516 D5CE.tmp 98 PID 516 wrote to memory of 4372 516 D5CE.tmp 98 PID 4372 wrote to memory of 1728 4372 D6A9.tmp 99 PID 4372 wrote to memory of 1728 4372 D6A9.tmp 99 PID 4372 wrote to memory of 1728 4372 D6A9.tmp 99 PID 1728 wrote to memory of 4720 1728 D736.tmp 100 PID 1728 wrote to memory of 4720 1728 D736.tmp 100 PID 1728 wrote to memory of 4720 1728 D736.tmp 100 PID 4720 wrote to memory of 3304 4720 D7C2.tmp 101 PID 4720 wrote to memory of 3304 4720 D7C2.tmp 101 PID 4720 wrote to memory of 3304 4720 D7C2.tmp 101 PID 3304 wrote to memory of 1460 3304 D88D.tmp 102 PID 3304 wrote to memory of 1460 3304 D88D.tmp 102 PID 3304 wrote to memory of 1460 3304 D88D.tmp 102 PID 1460 wrote to memory of 3432 1460 D90A.tmp 103 PID 1460 wrote to memory of 3432 1460 D90A.tmp 103 PID 1460 wrote to memory of 3432 1460 D90A.tmp 103 PID 3432 wrote to memory of 4220 3432 D9A7.tmp 104 PID 3432 wrote to memory of 4220 3432 D9A7.tmp 104 PID 3432 wrote to memory of 4220 3432 D9A7.tmp 104 PID 4220 wrote to memory of 1632 4220 DA24.tmp 105 PID 4220 wrote to memory of 1632 4220 DA24.tmp 105 PID 4220 wrote to memory of 1632 4220 DA24.tmp 105 PID 1632 wrote to memory of 884 1632 DAB0.tmp 106 PID 1632 wrote to memory of 884 1632 DAB0.tmp 106 PID 1632 wrote to memory of 884 1632 DAB0.tmp 106 PID 884 wrote to memory of 2604 884 DB5C.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-11_9ece7eca226ebdfe3def315f267770a0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-11_9ece7eca226ebdfe3def315f267770a0_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\CF17.tmp"C:\Users\Admin\AppData\Local\Temp\CF17.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\D002.tmp"C:\Users\Admin\AppData\Local\Temp\D002.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\D496.tmp"C:\Users\Admin\AppData\Local\Temp\D496.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\D736.tmp"C:\Users\Admin\AppData\Local\Temp\D736.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\D88D.tmp"C:\Users\Admin\AppData\Local\Temp\D88D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\DA24.tmp"C:\Users\Admin\AppData\Local\Temp\DA24.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\DC27.tmp"C:\Users\Admin\AppData\Local\Temp\DC27.tmp"23⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"24⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\DD50.tmp"C:\Users\Admin\AppData\Local\Temp\DD50.tmp"25⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"26⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"27⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\DF25.tmp"C:\Users\Admin\AppData\Local\Temp\DF25.tmp"28⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"29⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\E07D.tmp"C:\Users\Admin\AppData\Local\Temp\E07D.tmp"30⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\E119.tmp"C:\Users\Admin\AppData\Local\Temp\E119.tmp"31⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\E186.tmp"C:\Users\Admin\AppData\Local\Temp\E186.tmp"32⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"33⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"34⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\E31C.tmp"C:\Users\Admin\AppData\Local\Temp\E31C.tmp"35⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"36⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"37⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\E455.tmp"C:\Users\Admin\AppData\Local\Temp\E455.tmp"38⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"39⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"40⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"41⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"42⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"43⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"44⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"45⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\E781.tmp"C:\Users\Admin\AppData\Local\Temp\E781.tmp"46⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"47⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"48⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"49⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\E937.tmp"C:\Users\Admin\AppData\Local\Temp\E937.tmp"50⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\E985.tmp"C:\Users\Admin\AppData\Local\Temp\E985.tmp"51⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"52⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"53⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"54⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"55⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"56⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"57⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"58⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"59⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"60⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"61⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"62⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"63⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"64⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"65⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\EE48.tmp"C:\Users\Admin\AppData\Local\Temp\EE48.tmp"66⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\EE96.tmp"C:\Users\Admin\AppData\Local\Temp\EE96.tmp"67⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"68⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"69⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\EF80.tmp"C:\Users\Admin\AppData\Local\Temp\EF80.tmp"70⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"71⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"72⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"73⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"74⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"75⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"76⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"77⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"78⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\F25F.tmp"C:\Users\Admin\AppData\Local\Temp\F25F.tmp"79⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"80⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\F30B.tmp"C:\Users\Admin\AppData\Local\Temp\F30B.tmp"81⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"82⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"83⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"84⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\F462.tmp"C:\Users\Admin\AppData\Local\Temp\F462.tmp"85⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"86⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"87⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"88⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"89⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"90⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\F637.tmp"C:\Users\Admin\AppData\Local\Temp\F637.tmp"91⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"92⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"93⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"94⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\F770.tmp"C:\Users\Admin\AppData\Local\Temp\F770.tmp"95⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"96⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"97⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\F879.tmp"C:\Users\Admin\AppData\Local\Temp\F879.tmp"98⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"99⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\F915.tmp"C:\Users\Admin\AppData\Local\Temp\F915.tmp"100⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\F964.tmp"C:\Users\Admin\AppData\Local\Temp\F964.tmp"101⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"102⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"103⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"104⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"105⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"106⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\FB58.tmp"C:\Users\Admin\AppData\Local\Temp\FB58.tmp"107⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"108⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"109⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"110⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\FC90.tmp"C:\Users\Admin\AppData\Local\Temp\FC90.tmp"111⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"112⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"113⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"114⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"115⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\FE17.tmp"C:\Users\Admin\AppData\Local\Temp\FE17.tmp"116⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\FE65.tmp"C:\Users\Admin\AppData\Local\Temp\FE65.tmp"117⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"118⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"119⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"120⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"121⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"122⤵PID:1892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-