Analysis
-
max time kernel
157s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15-03-2024 05:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-15_f421bf03d767c8e3c658aa824bcfc322_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-15_f421bf03d767c8e3c658aa824bcfc322_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-03-15_f421bf03d767c8e3c658aa824bcfc322_mafia.exe
-
Size
486KB
-
MD5
f421bf03d767c8e3c658aa824bcfc322
-
SHA1
78c57b3fc8ee96087d3cb967eb670d207d30573d
-
SHA256
bbb48c0cbd30ac201a9306a6c30a3cd72942d4af289d5d77b48d6957da47c042
-
SHA512
1b4ac44f91725d7225a027cfbad62890d719417e67455228d9d300b5388de0eb6981678c25372001a5763e91d4cfb9cbe5ec3b36f96188e3850a612aa3e94724
-
SSDEEP
12288:/U5rCOTeiDHw01HF8I2DFxZwIjoaociz+BNZ:/UQOJDH3HF8RXZwVJciKN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2008 2BA.tmp 3172 3A5.tmp 4308 4CD.tmp 4172 5A8.tmp 2532 683.tmp 1840 74E.tmp 3548 829.tmp 2988 952.tmp 4508 A2C.tmp 4588 B46.tmp 3132 C40.tmp 1216 D49.tmp 3976 E91.tmp 4324 F6C.tmp 3672 1037.tmp 2520 1131.tmp 2452 122B.tmp 3576 1306.tmp 2440 1400.tmp 3264 14FA.tmp 4216 15D5.tmp 4600 16A0.tmp 2316 17D8.tmp 1692 1901.tmp 2784 19DC.tmp 4760 1A98.tmp 3268 1BA1.tmp 2400 1CBA.tmp 1132 1D66.tmp 3404 1E31.tmp 4304 1EED.tmp 1264 1F89.tmp 2340 2083.tmp 3672 215E.tmp 1968 21DB.tmp 2324 2248.tmp 3576 22D5.tmp 4104 2342.tmp 4316 23EE.tmp 972 246B.tmp 1960 2536.tmp 3376 25D3.tmp 1984 26BD.tmp 2804 2788.tmp 4528 2815.tmp 4008 28B1.tmp 772 29AB.tmp 3132 2A47.tmp 1796 2AE3.tmp 4384 2BBE.tmp 4924 2D74.tmp 3796 2E20.tmp 2364 2ECB.tmp 1968 2FA6.tmp 3576 3062.tmp 2272 311D.tmp 4996 31C9.tmp 4636 3275.tmp 4760 3330.tmp 2988 33CD.tmp 2400 3459.tmp 4676 34E6.tmp 3732 3582.tmp 2016 35FF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1776 wrote to memory of 2008 1776 2024-03-15_f421bf03d767c8e3c658aa824bcfc322_mafia.exe 98 PID 1776 wrote to memory of 2008 1776 2024-03-15_f421bf03d767c8e3c658aa824bcfc322_mafia.exe 98 PID 1776 wrote to memory of 2008 1776 2024-03-15_f421bf03d767c8e3c658aa824bcfc322_mafia.exe 98 PID 2008 wrote to memory of 3172 2008 2BA.tmp 99 PID 2008 wrote to memory of 3172 2008 2BA.tmp 99 PID 2008 wrote to memory of 3172 2008 2BA.tmp 99 PID 3172 wrote to memory of 4308 3172 3A5.tmp 100 PID 3172 wrote to memory of 4308 3172 3A5.tmp 100 PID 3172 wrote to memory of 4308 3172 3A5.tmp 100 PID 4308 wrote to memory of 4172 4308 4CD.tmp 101 PID 4308 wrote to memory of 4172 4308 4CD.tmp 101 PID 4308 wrote to memory of 4172 4308 4CD.tmp 101 PID 4172 wrote to memory of 2532 4172 5A8.tmp 102 PID 4172 wrote to memory of 2532 4172 5A8.tmp 102 PID 4172 wrote to memory of 2532 4172 5A8.tmp 102 PID 2532 wrote to memory of 1840 2532 683.tmp 103 PID 2532 wrote to memory of 1840 2532 683.tmp 103 PID 2532 wrote to memory of 1840 2532 683.tmp 103 PID 1840 wrote to memory of 3548 1840 74E.tmp 104 PID 1840 wrote to memory of 3548 1840 74E.tmp 104 PID 1840 wrote to memory of 3548 1840 74E.tmp 104 PID 3548 wrote to memory of 2988 3548 829.tmp 105 PID 3548 wrote to memory of 2988 3548 829.tmp 105 PID 3548 wrote to memory of 2988 3548 829.tmp 105 PID 2988 wrote to memory of 4508 2988 952.tmp 107 PID 2988 wrote to memory of 4508 2988 952.tmp 107 PID 2988 wrote to memory of 4508 2988 952.tmp 107 PID 4508 wrote to memory of 4588 4508 A2C.tmp 108 PID 4508 wrote to memory of 4588 4508 A2C.tmp 108 PID 4508 wrote to memory of 4588 4508 A2C.tmp 108 PID 4588 wrote to memory of 3132 4588 B46.tmp 109 PID 4588 wrote to memory of 3132 4588 B46.tmp 109 PID 4588 wrote to memory of 3132 4588 B46.tmp 109 PID 3132 wrote to memory of 1216 3132 C40.tmp 110 PID 3132 wrote to memory of 1216 3132 C40.tmp 110 PID 3132 wrote to memory of 1216 3132 C40.tmp 110 PID 1216 wrote to memory of 3976 1216 D49.tmp 112 PID 1216 wrote to memory of 3976 1216 D49.tmp 112 PID 1216 wrote to memory of 3976 1216 D49.tmp 112 PID 3976 wrote to memory of 4324 3976 E91.tmp 113 PID 3976 wrote to memory of 4324 3976 E91.tmp 113 PID 3976 wrote to memory of 4324 3976 E91.tmp 113 PID 4324 wrote to memory of 3672 4324 F6C.tmp 114 PID 4324 wrote to memory of 3672 4324 F6C.tmp 114 PID 4324 wrote to memory of 3672 4324 F6C.tmp 114 PID 3672 wrote to memory of 2520 3672 1037.tmp 115 PID 3672 wrote to memory of 2520 3672 1037.tmp 115 PID 3672 wrote to memory of 2520 3672 1037.tmp 115 PID 2520 wrote to memory of 2452 2520 1131.tmp 116 PID 2520 wrote to memory of 2452 2520 1131.tmp 116 PID 2520 wrote to memory of 2452 2520 1131.tmp 116 PID 2452 wrote to memory of 3576 2452 122B.tmp 117 PID 2452 wrote to memory of 3576 2452 122B.tmp 117 PID 2452 wrote to memory of 3576 2452 122B.tmp 117 PID 3576 wrote to memory of 2440 3576 1306.tmp 118 PID 3576 wrote to memory of 2440 3576 1306.tmp 118 PID 3576 wrote to memory of 2440 3576 1306.tmp 118 PID 2440 wrote to memory of 3264 2440 1400.tmp 119 PID 2440 wrote to memory of 3264 2440 1400.tmp 119 PID 2440 wrote to memory of 3264 2440 1400.tmp 119 PID 3264 wrote to memory of 4216 3264 14FA.tmp 120 PID 3264 wrote to memory of 4216 3264 14FA.tmp 120 PID 3264 wrote to memory of 4216 3264 14FA.tmp 120 PID 4216 wrote to memory of 4600 4216 15D5.tmp 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-15_f421bf03d767c8e3c658aa824bcfc322_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-15_f421bf03d767c8e3c658aa824bcfc322_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\2BA.tmp"C:\Users\Admin\AppData\Local\Temp\2BA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\3A5.tmp"C:\Users\Admin\AppData\Local\Temp\3A5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\4CD.tmp"C:\Users\Admin\AppData\Local\Temp\4CD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\74E.tmp"C:\Users\Admin\AppData\Local\Temp\74E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\829.tmp"C:\Users\Admin\AppData\Local\Temp\829.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\952.tmp"C:\Users\Admin\AppData\Local\Temp\952.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\D49.tmp"C:\Users\Admin\AppData\Local\Temp\D49.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\1131.tmp"C:\Users\Admin\AppData\Local\Temp\1131.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\122B.tmp"C:\Users\Admin\AppData\Local\Temp\122B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\1306.tmp"C:\Users\Admin\AppData\Local\Temp\1306.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\14FA.tmp"C:\Users\Admin\AppData\Local\Temp\14FA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\15D5.tmp"C:\Users\Admin\AppData\Local\Temp\15D5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"23⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\17D8.tmp"C:\Users\Admin\AppData\Local\Temp\17D8.tmp"24⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"25⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\19DC.tmp"C:\Users\Admin\AppData\Local\Temp\19DC.tmp"26⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"27⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"28⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"29⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"30⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\1E31.tmp"C:\Users\Admin\AppData\Local\Temp\1E31.tmp"31⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\1EED.tmp"C:\Users\Admin\AppData\Local\Temp\1EED.tmp"32⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\1F89.tmp"C:\Users\Admin\AppData\Local\Temp\1F89.tmp"33⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"34⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\2083.tmp"C:\Users\Admin\AppData\Local\Temp\2083.tmp"35⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\215E.tmp"C:\Users\Admin\AppData\Local\Temp\215E.tmp"36⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\21DB.tmp"C:\Users\Admin\AppData\Local\Temp\21DB.tmp"37⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\2248.tmp"C:\Users\Admin\AppData\Local\Temp\2248.tmp"38⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"39⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\2342.tmp"C:\Users\Admin\AppData\Local\Temp\2342.tmp"40⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"41⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"42⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\2536.tmp"C:\Users\Admin\AppData\Local\Temp\2536.tmp"43⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"44⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\26BD.tmp"C:\Users\Admin\AppData\Local\Temp\26BD.tmp"45⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"46⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\2815.tmp"C:\Users\Admin\AppData\Local\Temp\2815.tmp"47⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"48⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\29AB.tmp"C:\Users\Admin\AppData\Local\Temp\29AB.tmp"49⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\2A47.tmp"C:\Users\Admin\AppData\Local\Temp\2A47.tmp"50⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"51⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"52⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\2D74.tmp"C:\Users\Admin\AppData\Local\Temp\2D74.tmp"53⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\2E20.tmp"C:\Users\Admin\AppData\Local\Temp\2E20.tmp"54⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"55⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"56⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3062.tmp"C:\Users\Admin\AppData\Local\Temp\3062.tmp"57⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\311D.tmp"C:\Users\Admin\AppData\Local\Temp\311D.tmp"58⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\31C9.tmp"C:\Users\Admin\AppData\Local\Temp\31C9.tmp"59⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\3275.tmp"C:\Users\Admin\AppData\Local\Temp\3275.tmp"60⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\3330.tmp"C:\Users\Admin\AppData\Local\Temp\3330.tmp"61⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"62⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"63⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"64⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"65⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"66⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\369B.tmp"C:\Users\Admin\AppData\Local\Temp\369B.tmp"67⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"68⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"69⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\3870.tmp"C:\Users\Admin\AppData\Local\Temp\3870.tmp"70⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\38FD.tmp"C:\Users\Admin\AppData\Local\Temp\38FD.tmp"71⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"72⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\39F7.tmp"C:\Users\Admin\AppData\Local\Temp\39F7.tmp"73⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"74⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"75⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"76⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"77⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\3D23.tmp"C:\Users\Admin\AppData\Local\Temp\3D23.tmp"78⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"79⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"80⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"81⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\3F56.tmp"C:\Users\Admin\AppData\Local\Temp\3F56.tmp"82⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"83⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\406F.tmp"C:\Users\Admin\AppData\Local\Temp\406F.tmp"84⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\411B.tmp"C:\Users\Admin\AppData\Local\Temp\411B.tmp"85⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"86⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\4234.tmp"C:\Users\Admin\AppData\Local\Temp\4234.tmp"87⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\42B1.tmp"C:\Users\Admin\AppData\Local\Temp\42B1.tmp"88⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\433E.tmp"C:\Users\Admin\AppData\Local\Temp\433E.tmp"89⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\43F9.tmp"C:\Users\Admin\AppData\Local\Temp\43F9.tmp"90⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\4486.tmp"C:\Users\Admin\AppData\Local\Temp\4486.tmp"91⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\4522.tmp"C:\Users\Admin\AppData\Local\Temp\4522.tmp"92⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\4590.tmp"C:\Users\Admin\AppData\Local\Temp\4590.tmp"93⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\467A.tmp"C:\Users\Admin\AppData\Local\Temp\467A.tmp"94⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\4707.tmp"C:\Users\Admin\AppData\Local\Temp\4707.tmp"95⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"96⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\47F1.tmp"C:\Users\Admin\AppData\Local\Temp\47F1.tmp"97⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\489D.tmp"C:\Users\Admin\AppData\Local\Temp\489D.tmp"98⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\4929.tmp"C:\Users\Admin\AppData\Local\Temp\4929.tmp"99⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\49B6.tmp"C:\Users\Admin\AppData\Local\Temp\49B6.tmp"100⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\4A33.tmp"C:\Users\Admin\AppData\Local\Temp\4A33.tmp"101⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"102⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"103⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"104⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\4C17.tmp"C:\Users\Admin\AppData\Local\Temp\4C17.tmp"105⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\4C94.tmp"C:\Users\Admin\AppData\Local\Temp\4C94.tmp"106⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"107⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"108⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\4E88.tmp"C:\Users\Admin\AppData\Local\Temp\4E88.tmp"109⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\4F63.tmp"C:\Users\Admin\AppData\Local\Temp\4F63.tmp"110⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"111⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\506D.tmp"C:\Users\Admin\AppData\Local\Temp\506D.tmp"112⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\50EA.tmp"C:\Users\Admin\AppData\Local\Temp\50EA.tmp"113⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\5186.tmp"C:\Users\Admin\AppData\Local\Temp\5186.tmp"114⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\5213.tmp"C:\Users\Admin\AppData\Local\Temp\5213.tmp"115⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\529F.tmp"C:\Users\Admin\AppData\Local\Temp\529F.tmp"116⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\530D.tmp"C:\Users\Admin\AppData\Local\Temp\530D.tmp"117⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"118⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\5407.tmp"C:\Users\Admin\AppData\Local\Temp\5407.tmp"119⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\5493.tmp"C:\Users\Admin\AppData\Local\Temp\5493.tmp"120⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\5501.tmp"C:\Users\Admin\AppData\Local\Temp\5501.tmp"121⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\558D.tmp"C:\Users\Admin\AppData\Local\Temp\558D.tmp"122⤵PID:1392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-