Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 07:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe
-
Size
530KB
-
MD5
f3ad8bbac1f782a598e2ba4fc3a2efd7
-
SHA1
b7490a23044b5b3d9969baba5c69bf3b02e676e4
-
SHA256
7623664fcb5cdfe8ddc98aaf747525056362c75637fbb4a09a5ded58022fc2f3
-
SHA512
c7064f5ff9102c645e3ae1349ac620cbfd921398ae54e39610a7ff2203bdbdc11169a1ceed9917f4aed0db66a488e772e818f438e27921a72740f894c445f52e
-
SSDEEP
12288:AU5rCOTeioKRLakAd6TNN5+onCe4Hvx6gUbNZulFVg0M1:AUQOJoKRBAGNN574Px6ggNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1952 8AAC.tmp 2104 8B58.tmp 2232 8BC5.tmp 5064 8C42.tmp 3040 8CA0.tmp 5040 8D1D.tmp 4256 8DB9.tmp 2248 8E46.tmp 2304 8ED2.tmp 3224 8F4F.tmp 2692 8FDC.tmp 1924 902A.tmp 4076 9088.tmp 3580 90D6.tmp 440 9163.tmp 1812 91D0.tmp 2056 923D.tmp 1080 928B.tmp 4856 92E9.tmp 2016 9347.tmp 4996 93A5.tmp 3548 9431.tmp 3836 949F.tmp 3564 951C.tmp 4168 9579.tmp 1600 95F6.tmp 4104 9664.tmp 3244 96C2.tmp 3260 974E.tmp 3620 97AC.tmp 1636 9819.tmp 5108 98A6.tmp 5116 9933.tmp 1456 9981.tmp 1952 99CF.tmp 4400 9A2D.tmp 4932 9A8A.tmp 3264 9AD8.tmp 5084 9B27.tmp 2600 9B84.tmp 4808 9BE2.tmp 4232 9C30.tmp 3040 9C7E.tmp 2204 9CDC.tmp 3760 9D3A.tmp 1692 9D98.tmp 1664 9DE6.tmp 3860 9E34.tmp 2304 9E92.tmp 3280 9EEF.tmp 2096 9F3D.tmp 3936 9FAB.tmp 2064 A009.tmp 1120 A066.tmp 1372 A0C4.tmp 4868 A122.tmp 924 A170.tmp 4828 A1CE.tmp 4956 A22B.tmp 4980 A289.tmp 2920 A2D7.tmp 4460 A335.tmp 4636 A393.tmp 3136 A3F1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3964 wrote to memory of 1952 3964 2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe 83 PID 3964 wrote to memory of 1952 3964 2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe 83 PID 3964 wrote to memory of 1952 3964 2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe 83 PID 1952 wrote to memory of 2104 1952 8AAC.tmp 84 PID 1952 wrote to memory of 2104 1952 8AAC.tmp 84 PID 1952 wrote to memory of 2104 1952 8AAC.tmp 84 PID 2104 wrote to memory of 2232 2104 8B58.tmp 86 PID 2104 wrote to memory of 2232 2104 8B58.tmp 86 PID 2104 wrote to memory of 2232 2104 8B58.tmp 86 PID 2232 wrote to memory of 5064 2232 8BC5.tmp 87 PID 2232 wrote to memory of 5064 2232 8BC5.tmp 87 PID 2232 wrote to memory of 5064 2232 8BC5.tmp 87 PID 5064 wrote to memory of 3040 5064 8C42.tmp 89 PID 5064 wrote to memory of 3040 5064 8C42.tmp 89 PID 5064 wrote to memory of 3040 5064 8C42.tmp 89 PID 3040 wrote to memory of 5040 3040 8CA0.tmp 90 PID 3040 wrote to memory of 5040 3040 8CA0.tmp 90 PID 3040 wrote to memory of 5040 3040 8CA0.tmp 90 PID 5040 wrote to memory of 4256 5040 8D1D.tmp 92 PID 5040 wrote to memory of 4256 5040 8D1D.tmp 92 PID 5040 wrote to memory of 4256 5040 8D1D.tmp 92 PID 4256 wrote to memory of 2248 4256 8DB9.tmp 93 PID 4256 wrote to memory of 2248 4256 8DB9.tmp 93 PID 4256 wrote to memory of 2248 4256 8DB9.tmp 93 PID 2248 wrote to memory of 2304 2248 8E46.tmp 94 PID 2248 wrote to memory of 2304 2248 8E46.tmp 94 PID 2248 wrote to memory of 2304 2248 8E46.tmp 94 PID 2304 wrote to memory of 3224 2304 8ED2.tmp 95 PID 2304 wrote to memory of 3224 2304 8ED2.tmp 95 PID 2304 wrote to memory of 3224 2304 8ED2.tmp 95 PID 3224 wrote to memory of 2692 3224 8F4F.tmp 96 PID 3224 wrote to memory of 2692 3224 8F4F.tmp 96 PID 3224 wrote to memory of 2692 3224 8F4F.tmp 96 PID 2692 wrote to memory of 1924 2692 8FDC.tmp 97 PID 2692 wrote to memory of 1924 2692 8FDC.tmp 97 PID 2692 wrote to memory of 1924 2692 8FDC.tmp 97 PID 1924 wrote to memory of 4076 1924 902A.tmp 98 PID 1924 wrote to memory of 4076 1924 902A.tmp 98 PID 1924 wrote to memory of 4076 1924 902A.tmp 98 PID 4076 wrote to memory of 3580 4076 9088.tmp 99 PID 4076 wrote to memory of 3580 4076 9088.tmp 99 PID 4076 wrote to memory of 3580 4076 9088.tmp 99 PID 3580 wrote to memory of 440 3580 90D6.tmp 100 PID 3580 wrote to memory of 440 3580 90D6.tmp 100 PID 3580 wrote to memory of 440 3580 90D6.tmp 100 PID 440 wrote to memory of 1812 440 9163.tmp 101 PID 440 wrote to memory of 1812 440 9163.tmp 101 PID 440 wrote to memory of 1812 440 9163.tmp 101 PID 1812 wrote to memory of 2056 1812 91D0.tmp 102 PID 1812 wrote to memory of 2056 1812 91D0.tmp 102 PID 1812 wrote to memory of 2056 1812 91D0.tmp 102 PID 2056 wrote to memory of 1080 2056 923D.tmp 103 PID 2056 wrote to memory of 1080 2056 923D.tmp 103 PID 2056 wrote to memory of 1080 2056 923D.tmp 103 PID 1080 wrote to memory of 4856 1080 928B.tmp 104 PID 1080 wrote to memory of 4856 1080 928B.tmp 104 PID 1080 wrote to memory of 4856 1080 928B.tmp 104 PID 4856 wrote to memory of 2016 4856 92E9.tmp 105 PID 4856 wrote to memory of 2016 4856 92E9.tmp 105 PID 4856 wrote to memory of 2016 4856 92E9.tmp 105 PID 2016 wrote to memory of 4996 2016 9347.tmp 106 PID 2016 wrote to memory of 4996 2016 9347.tmp 106 PID 2016 wrote to memory of 4996 2016 9347.tmp 106 PID 4996 wrote to memory of 3548 4996 93A5.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"23⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"24⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"25⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"26⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"27⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"28⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"29⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"30⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"31⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"32⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"33⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"34⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"35⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"36⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"37⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"38⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"39⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"40⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"41⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"42⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"43⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"44⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"45⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"46⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"47⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"48⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"49⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"50⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"51⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"52⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"53⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"54⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"55⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"56⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"57⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"58⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"59⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"60⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"61⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"62⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"63⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"64⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"65⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"66⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"67⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"68⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"69⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"70⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"71⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"72⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"73⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"74⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"75⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"76⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"77⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"78⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"79⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"80⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"81⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"82⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"83⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"84⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"85⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"86⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"87⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"88⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"89⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"90⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"91⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"92⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"93⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"94⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"95⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"96⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"97⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"98⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"99⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"100⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"101⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"102⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"103⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"104⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"105⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"106⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"107⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"108⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"109⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"110⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"111⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"112⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"113⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"114⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"115⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"116⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"117⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"118⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"119⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"120⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"121⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"122⤵PID:1388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-