Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 19:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-03_ad6a16417d2731a260d4d0486942c860_mafia.exe
Resource
win7-20240611-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-03_ad6a16417d2731a260d4d0486942c860_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-07-03_ad6a16417d2731a260d4d0486942c860_mafia.exe
-
Size
529KB
-
MD5
ad6a16417d2731a260d4d0486942c860
-
SHA1
6a0c4644c11bd9613af5dd38ca08f47fa0c5ffff
-
SHA256
5c4c25cf82009a5a6ef7f19c2a12080eeb1fc248a08b9aa4c8b6d120b3027eb0
-
SHA512
3191fedcefd79593b4324c9ebb39f607fe2b5eb903e906e374680d7dfdb462b0082bb649b10318e4c758b6d7dd8132654bd1cae8246af411bfacaeed0164d7f0
-
SSDEEP
12288:NU5rCOTeijLAn/zRF8yI9mYtUMg6FhTZwlH4Hp:NUQOJj8VF8yIHtUMg6FhTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2372 DFF0.tmp 2080 E05D.tmp 860 E0CB.tmp 5060 E148.tmp 3320 E1E4.tmp 2924 E280.tmp 404 E2DE.tmp 3668 E33C.tmp 5080 E399.tmp 1168 E407.tmp 1292 E465.tmp 4348 E4F1.tmp 4020 E56E.tmp 1012 E5BC.tmp 3684 E649.tmp 2408 E6A7.tmp 1748 E733.tmp 1608 E781.tmp 4668 E7FE.tmp 116 E86C.tmp 4064 E8CA.tmp 3972 E937.tmp 1716 E9B4.tmp 3628 EA12.tmp 4836 EA60.tmp 1256 EAAE.tmp 1560 EB0C.tmp 3152 EB89.tmp 2060 EBD7.tmp 4300 EC25.tmp 4692 EC92.tmp 3112 ECF0.tmp 1268 ED6D.tmp 3704 EDCB.tmp 3040 EE29.tmp 1000 EE86.tmp 2180 EEE4.tmp 60 EF42.tmp 4060 EF90.tmp 2652 EFEE.tmp 836 F03C.tmp 2368 F08A.tmp 4980 F0D8.tmp 4584 F126.tmp 684 F174.tmp 1856 F1C2.tmp 1952 F230.tmp 2012 F27E.tmp 1728 F2CC.tmp 4396 F31A.tmp 2832 F368.tmp 1524 F3B6.tmp 1412 F414.tmp 1064 F462.tmp 4700 F4B0.tmp 2568 F4FF.tmp 2644 F54D.tmp 4356 F59B.tmp 4372 F5F9.tmp 3996 F647.tmp 928 F6A4.tmp 2220 F6F3.tmp 2860 F741.tmp 1720 F78F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2372 2088 2024-07-03_ad6a16417d2731a260d4d0486942c860_mafia.exe 88 PID 2088 wrote to memory of 2372 2088 2024-07-03_ad6a16417d2731a260d4d0486942c860_mafia.exe 88 PID 2088 wrote to memory of 2372 2088 2024-07-03_ad6a16417d2731a260d4d0486942c860_mafia.exe 88 PID 2372 wrote to memory of 2080 2372 DFF0.tmp 89 PID 2372 wrote to memory of 2080 2372 DFF0.tmp 89 PID 2372 wrote to memory of 2080 2372 DFF0.tmp 89 PID 2080 wrote to memory of 860 2080 E05D.tmp 90 PID 2080 wrote to memory of 860 2080 E05D.tmp 90 PID 2080 wrote to memory of 860 2080 E05D.tmp 90 PID 860 wrote to memory of 5060 860 E0CB.tmp 91 PID 860 wrote to memory of 5060 860 E0CB.tmp 91 PID 860 wrote to memory of 5060 860 E0CB.tmp 91 PID 5060 wrote to memory of 3320 5060 E148.tmp 92 PID 5060 wrote to memory of 3320 5060 E148.tmp 92 PID 5060 wrote to memory of 3320 5060 E148.tmp 92 PID 3320 wrote to memory of 2924 3320 E1E4.tmp 93 PID 3320 wrote to memory of 2924 3320 E1E4.tmp 93 PID 3320 wrote to memory of 2924 3320 E1E4.tmp 93 PID 2924 wrote to memory of 404 2924 E280.tmp 94 PID 2924 wrote to memory of 404 2924 E280.tmp 94 PID 2924 wrote to memory of 404 2924 E280.tmp 94 PID 404 wrote to memory of 3668 404 E2DE.tmp 95 PID 404 wrote to memory of 3668 404 E2DE.tmp 95 PID 404 wrote to memory of 3668 404 E2DE.tmp 95 PID 3668 wrote to memory of 5080 3668 E33C.tmp 96 PID 3668 wrote to memory of 5080 3668 E33C.tmp 96 PID 3668 wrote to memory of 5080 3668 E33C.tmp 96 PID 5080 wrote to memory of 1168 5080 E399.tmp 97 PID 5080 wrote to memory of 1168 5080 E399.tmp 97 PID 5080 wrote to memory of 1168 5080 E399.tmp 97 PID 1168 wrote to memory of 1292 1168 E407.tmp 98 PID 1168 wrote to memory of 1292 1168 E407.tmp 98 PID 1168 wrote to memory of 1292 1168 E407.tmp 98 PID 1292 wrote to memory of 4348 1292 E465.tmp 99 PID 1292 wrote to memory of 4348 1292 E465.tmp 99 PID 1292 wrote to memory of 4348 1292 E465.tmp 99 PID 4348 wrote to memory of 4020 4348 E4F1.tmp 100 PID 4348 wrote to memory of 4020 4348 E4F1.tmp 100 PID 4348 wrote to memory of 4020 4348 E4F1.tmp 100 PID 4020 wrote to memory of 1012 4020 E56E.tmp 101 PID 4020 wrote to memory of 1012 4020 E56E.tmp 101 PID 4020 wrote to memory of 1012 4020 E56E.tmp 101 PID 1012 wrote to memory of 3684 1012 E5BC.tmp 102 PID 1012 wrote to memory of 3684 1012 E5BC.tmp 102 PID 1012 wrote to memory of 3684 1012 E5BC.tmp 102 PID 3684 wrote to memory of 2408 3684 E649.tmp 103 PID 3684 wrote to memory of 2408 3684 E649.tmp 103 PID 3684 wrote to memory of 2408 3684 E649.tmp 103 PID 2408 wrote to memory of 1748 2408 E6A7.tmp 104 PID 2408 wrote to memory of 1748 2408 E6A7.tmp 104 PID 2408 wrote to memory of 1748 2408 E6A7.tmp 104 PID 1748 wrote to memory of 1608 1748 E733.tmp 105 PID 1748 wrote to memory of 1608 1748 E733.tmp 105 PID 1748 wrote to memory of 1608 1748 E733.tmp 105 PID 1608 wrote to memory of 4668 1608 E781.tmp 106 PID 1608 wrote to memory of 4668 1608 E781.tmp 106 PID 1608 wrote to memory of 4668 1608 E781.tmp 106 PID 4668 wrote to memory of 116 4668 E7FE.tmp 107 PID 4668 wrote to memory of 116 4668 E7FE.tmp 107 PID 4668 wrote to memory of 116 4668 E7FE.tmp 107 PID 116 wrote to memory of 4064 116 E86C.tmp 108 PID 116 wrote to memory of 4064 116 E86C.tmp 108 PID 116 wrote to memory of 4064 116 E86C.tmp 108 PID 4064 wrote to memory of 3972 4064 E8CA.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_ad6a16417d2731a260d4d0486942c860_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_ad6a16417d2731a260d4d0486942c860_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\E148.tmp"C:\Users\Admin\AppData\Local\Temp\E148.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\E33C.tmp"C:\Users\Admin\AppData\Local\Temp\E33C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\E399.tmp"C:\Users\Admin\AppData\Local\Temp\E399.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\E407.tmp"C:\Users\Admin\AppData\Local\Temp\E407.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\E56E.tmp"C:\Users\Admin\AppData\Local\Temp\E56E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\E781.tmp"C:\Users\Admin\AppData\Local\Temp\E781.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\E937.tmp"C:\Users\Admin\AppData\Local\Temp\E937.tmp"23⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"24⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"25⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"26⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"27⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"28⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"29⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"30⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\EC25.tmp"C:\Users\Admin\AppData\Local\Temp\EC25.tmp"31⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\EC92.tmp"C:\Users\Admin\AppData\Local\Temp\EC92.tmp"32⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"33⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"34⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"35⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"36⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"37⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"38⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\EF42.tmp"C:\Users\Admin\AppData\Local\Temp\EF42.tmp"39⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"40⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"41⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"42⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"43⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"44⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"45⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"46⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"47⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"48⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\F27E.tmp"C:\Users\Admin\AppData\Local\Temp\F27E.tmp"49⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"50⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"51⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"52⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"53⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"54⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\F462.tmp"C:\Users\Admin\AppData\Local\Temp\F462.tmp"55⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"56⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"57⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"58⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"59⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"60⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\F647.tmp"C:\Users\Admin\AppData\Local\Temp\F647.tmp"61⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"62⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"63⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\F741.tmp"C:\Users\Admin\AppData\Local\Temp\F741.tmp"64⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"65⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"66⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\F83B.tmp"C:\Users\Admin\AppData\Local\Temp\F83B.tmp"67⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"68⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"69⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"70⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"71⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"72⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"73⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\FABB.tmp"C:\Users\Admin\AppData\Local\Temp\FABB.tmp"74⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"75⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\FB67.tmp"C:\Users\Admin\AppData\Local\Temp\FB67.tmp"76⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"77⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"78⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"79⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"80⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"81⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"82⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"83⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"84⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\FE84.tmp"C:\Users\Admin\AppData\Local\Temp\FE84.tmp"85⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"86⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"87⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"88⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"89⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"90⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"91⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"92⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"93⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\1C0.tmp"C:\Users\Admin\AppData\Local\Temp\1C0.tmp"94⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"95⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"96⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"97⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"98⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"99⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\3E3.tmp"C:\Users\Admin\AppData\Local\Temp\3E3.tmp"100⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"101⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"102⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"103⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"104⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"105⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp"106⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"107⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\6C1.tmp"C:\Users\Admin\AppData\Local\Temp\6C1.tmp"108⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\710.tmp"C:\Users\Admin\AppData\Local\Temp\710.tmp"109⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\75E.tmp"C:\Users\Admin\AppData\Local\Temp\75E.tmp"110⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"111⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\819.tmp"C:\Users\Admin\AppData\Local\Temp\819.tmp"112⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\867.tmp"C:\Users\Admin\AppData\Local\Temp\867.tmp"113⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\8C5.tmp"C:\Users\Admin\AppData\Local\Temp\8C5.tmp"114⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"115⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"116⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"117⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\A3C.tmp"C:\Users\Admin\AppData\Local\Temp\A3C.tmp"118⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"119⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\AE8.tmp"C:\Users\Admin\AppData\Local\Temp\AE8.tmp"120⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"121⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"122⤵PID:2060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-