Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-03-2024 00:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe
-
Size
487KB
-
MD5
3e039ed8791b4f5173be4634a9ddef20
-
SHA1
5881946737bbd1b07a58a9f02b622f2751e99dd9
-
SHA256
632f8a5a238750fa99dbe634838eac81708d51b4a1f18372cee67d9a2874cb9c
-
SHA512
81a6d8305559ac46c166e1f51b5efbb83c780530330e01d021f085630239b93bf43d629f56dd8e1c18f2e391275bf4651ea1ac198a69c3771be235fb0ede6179
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDx02p4zBKF5NDQwXgmxlPHZgKXgWPOU4mwubQ6:yU5rCOTeiN22p48FDxLxEij1wuUFgbZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3612 E530.tmp 1132 E678.tmp 736 E704.tmp 3360 E80E.tmp 3696 E908.tmp 3896 E9E3.tmp 4364 EABE.tmp 3080 EB5A.tmp 916 EC83.tmp 2424 ED8C.tmp 4928 EE67.tmp 3700 EF13.tmp 1768 F02C.tmp 436 F0F7.tmp 1856 F1D2.tmp 3052 F25F.tmp 4296 F339.tmp 4992 F4D0.tmp 2008 F58B.tmp 2100 F695.tmp 3612 F770.tmp 5024 F81B.tmp 5068 F8E7.tmp 3760 F9C1.tmp 2392 FA4E.tmp 1920 FB09.tmp 2608 FBB5.tmp 4320 FC90.tmp 3376 FDA9.tmp 2652 C6.tmp 3560 191.tmp 1992 26C.tmp 4240 366.tmp 3672 470.tmp 4608 53B.tmp 436 5B8.tmp 1856 625.tmp 4328 6A2.tmp 4144 71F.tmp 2912 79C.tmp 1444 887.tmp 2984 913.tmp 4372 9A0.tmp 3760 A0D.tmp 1432 A9A.tmp 1240 B17.tmp 2440 B94.tmp 4180 C20.tmp 4368 C9D.tmp 3164 D0B.tmp 2652 D78.tmp 2884 E14.tmp 3700 E82.tmp 4540 F0E.tmp 2220 F8B.tmp 4240 FF9.tmp 2556 1076.tmp 2728 1112.tmp 3284 119F.tmp 1156 120C.tmp 4004 1289.tmp 4608 12F6.tmp 436 1373.tmp 3704 141F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1548 wrote to memory of 3612 1548 2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe 95 PID 1548 wrote to memory of 3612 1548 2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe 95 PID 1548 wrote to memory of 3612 1548 2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe 95 PID 3612 wrote to memory of 1132 3612 E530.tmp 97 PID 3612 wrote to memory of 1132 3612 E530.tmp 97 PID 3612 wrote to memory of 1132 3612 E530.tmp 97 PID 1132 wrote to memory of 736 1132 E678.tmp 98 PID 1132 wrote to memory of 736 1132 E678.tmp 98 PID 1132 wrote to memory of 736 1132 E678.tmp 98 PID 736 wrote to memory of 3360 736 E704.tmp 99 PID 736 wrote to memory of 3360 736 E704.tmp 99 PID 736 wrote to memory of 3360 736 E704.tmp 99 PID 3360 wrote to memory of 3696 3360 E80E.tmp 100 PID 3360 wrote to memory of 3696 3360 E80E.tmp 100 PID 3360 wrote to memory of 3696 3360 E80E.tmp 100 PID 3696 wrote to memory of 3896 3696 E908.tmp 102 PID 3696 wrote to memory of 3896 3696 E908.tmp 102 PID 3696 wrote to memory of 3896 3696 E908.tmp 102 PID 3896 wrote to memory of 4364 3896 E9E3.tmp 103 PID 3896 wrote to memory of 4364 3896 E9E3.tmp 103 PID 3896 wrote to memory of 4364 3896 E9E3.tmp 103 PID 4364 wrote to memory of 3080 4364 EABE.tmp 104 PID 4364 wrote to memory of 3080 4364 EABE.tmp 104 PID 4364 wrote to memory of 3080 4364 EABE.tmp 104 PID 3080 wrote to memory of 916 3080 EB5A.tmp 105 PID 3080 wrote to memory of 916 3080 EB5A.tmp 105 PID 3080 wrote to memory of 916 3080 EB5A.tmp 105 PID 916 wrote to memory of 2424 916 EC83.tmp 106 PID 916 wrote to memory of 2424 916 EC83.tmp 106 PID 916 wrote to memory of 2424 916 EC83.tmp 106 PID 2424 wrote to memory of 4928 2424 ED8C.tmp 107 PID 2424 wrote to memory of 4928 2424 ED8C.tmp 107 PID 2424 wrote to memory of 4928 2424 ED8C.tmp 107 PID 4928 wrote to memory of 3700 4928 EE67.tmp 108 PID 4928 wrote to memory of 3700 4928 EE67.tmp 108 PID 4928 wrote to memory of 3700 4928 EE67.tmp 108 PID 3700 wrote to memory of 1768 3700 EF13.tmp 109 PID 3700 wrote to memory of 1768 3700 EF13.tmp 109 PID 3700 wrote to memory of 1768 3700 EF13.tmp 109 PID 1768 wrote to memory of 436 1768 F02C.tmp 111 PID 1768 wrote to memory of 436 1768 F02C.tmp 111 PID 1768 wrote to memory of 436 1768 F02C.tmp 111 PID 436 wrote to memory of 1856 436 F0F7.tmp 112 PID 436 wrote to memory of 1856 436 F0F7.tmp 112 PID 436 wrote to memory of 1856 436 F0F7.tmp 112 PID 1856 wrote to memory of 3052 1856 F1D2.tmp 113 PID 1856 wrote to memory of 3052 1856 F1D2.tmp 113 PID 1856 wrote to memory of 3052 1856 F1D2.tmp 113 PID 3052 wrote to memory of 4296 3052 F25F.tmp 114 PID 3052 wrote to memory of 4296 3052 F25F.tmp 114 PID 3052 wrote to memory of 4296 3052 F25F.tmp 114 PID 4296 wrote to memory of 4992 4296 F339.tmp 116 PID 4296 wrote to memory of 4992 4296 F339.tmp 116 PID 4296 wrote to memory of 4992 4296 F339.tmp 116 PID 4992 wrote to memory of 2008 4992 F4D0.tmp 117 PID 4992 wrote to memory of 2008 4992 F4D0.tmp 117 PID 4992 wrote to memory of 2008 4992 F4D0.tmp 117 PID 2008 wrote to memory of 2100 2008 F58B.tmp 118 PID 2008 wrote to memory of 2100 2008 F58B.tmp 118 PID 2008 wrote to memory of 2100 2008 F58B.tmp 118 PID 2100 wrote to memory of 3612 2100 F695.tmp 119 PID 2100 wrote to memory of 3612 2100 F695.tmp 119 PID 2100 wrote to memory of 3612 2100 F695.tmp 119 PID 3612 wrote to memory of 5024 3612 F770.tmp 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\E530.tmp"C:\Users\Admin\AppData\Local\Temp\E530.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\E704.tmp"C:\Users\Admin\AppData\Local\Temp\E704.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\EC83.tmp"C:\Users\Admin\AppData\Local\Temp\EC83.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\EE67.tmp"C:\Users\Admin\AppData\Local\Temp\EE67.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\EF13.tmp"C:\Users\Admin\AppData\Local\Temp\EF13.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\F25F.tmp"C:\Users\Admin\AppData\Local\Temp\F25F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\F695.tmp"C:\Users\Admin\AppData\Local\Temp\F695.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\F770.tmp"C:\Users\Admin\AppData\Local\Temp\F770.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"23⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"24⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"25⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"26⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"27⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"28⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\FC90.tmp"C:\Users\Admin\AppData\Local\Temp\FC90.tmp"29⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"30⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6.tmp"31⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"32⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"33⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"34⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\470.tmp"C:\Users\Admin\AppData\Local\Temp\470.tmp"35⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\53B.tmp"C:\Users\Admin\AppData\Local\Temp\53B.tmp"36⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"37⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\625.tmp"C:\Users\Admin\AppData\Local\Temp\625.tmp"38⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"39⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"40⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\79C.tmp"C:\Users\Admin\AppData\Local\Temp\79C.tmp"41⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\887.tmp"C:\Users\Admin\AppData\Local\Temp\887.tmp"42⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\913.tmp"C:\Users\Admin\AppData\Local\Temp\913.tmp"43⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"44⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\A0D.tmp"C:\Users\Admin\AppData\Local\Temp\A0D.tmp"45⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"46⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp"47⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\B94.tmp"C:\Users\Admin\AppData\Local\Temp\B94.tmp"48⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\C20.tmp"C:\Users\Admin\AppData\Local\Temp\C20.tmp"49⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"50⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"51⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"52⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"53⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"54⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"55⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"56⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\FF9.tmp"C:\Users\Admin\AppData\Local\Temp\FF9.tmp"57⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"58⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"59⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\119F.tmp"C:\Users\Admin\AppData\Local\Temp\119F.tmp"60⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"61⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\1289.tmp"C:\Users\Admin\AppData\Local\Temp\1289.tmp"62⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"63⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"64⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"65⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\148D.tmp"C:\Users\Admin\AppData\Local\Temp\148D.tmp"66⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"67⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"68⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"69⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"70⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"71⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\17F8.tmp"C:\Users\Admin\AppData\Local\Temp\17F8.tmp"72⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\1894.tmp"C:\Users\Admin\AppData\Local\Temp\1894.tmp"73⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"74⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"75⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\19FB.tmp"C:\Users\Admin\AppData\Local\Temp\19FB.tmp"76⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\1A78.tmp"C:\Users\Admin\AppData\Local\Temp\1A78.tmp"77⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"78⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\1B72.tmp"C:\Users\Admin\AppData\Local\Temp\1B72.tmp"79⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"80⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"81⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\1D86.tmp"C:\Users\Admin\AppData\Local\Temp\1D86.tmp"82⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"83⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"84⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"85⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"86⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"87⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\20D1.tmp"C:\Users\Admin\AppData\Local\Temp\20D1.tmp"88⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\216E.tmp"C:\Users\Admin\AppData\Local\Temp\216E.tmp"89⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\21EB.tmp"C:\Users\Admin\AppData\Local\Temp\21EB.tmp"90⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\2268.tmp"C:\Users\Admin\AppData\Local\Temp\2268.tmp"91⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"92⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\2362.tmp"C:\Users\Admin\AppData\Local\Temp\2362.tmp"93⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\23CF.tmp"C:\Users\Admin\AppData\Local\Temp\23CF.tmp"94⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\243C.tmp"C:\Users\Admin\AppData\Local\Temp\243C.tmp"95⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"96⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"97⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"98⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\267E.tmp"C:\Users\Admin\AppData\Local\Temp\267E.tmp"99⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\270B.tmp"C:\Users\Admin\AppData\Local\Temp\270B.tmp"100⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"101⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\2815.tmp"C:\Users\Admin\AppData\Local\Temp\2815.tmp"102⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"103⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"104⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"105⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\2A66.tmp"C:\Users\Admin\AppData\Local\Temp\2A66.tmp"106⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"107⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"108⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\2D45.tmp"C:\Users\Admin\AppData\Local\Temp\2D45.tmp"109⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"110⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"111⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"112⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"113⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"114⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\3004.tmp"C:\Users\Admin\AppData\Local\Temp\3004.tmp"115⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\3081.tmp"C:\Users\Admin\AppData\Local\Temp\3081.tmp"116⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"117⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\315C.tmp"C:\Users\Admin\AppData\Local\Temp\315C.tmp"118⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\31C9.tmp"C:\Users\Admin\AppData\Local\Temp\31C9.tmp"119⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"120⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\32E2.tmp"C:\Users\Admin\AppData\Local\Temp\32E2.tmp"121⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\335F.tmp"C:\Users\Admin\AppData\Local\Temp\335F.tmp"122⤵PID:3012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-