Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 01:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-15_ffc1899a36f839e767607b02041eae80_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-15_ffc1899a36f839e767607b02041eae80_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-15_ffc1899a36f839e767607b02041eae80_mafia.exe
-
Size
488KB
-
MD5
ffc1899a36f839e767607b02041eae80
-
SHA1
bf57d41f87b63bfb7b11972be2f9b34de7eb018b
-
SHA256
17346341a0c4f94103260bf3d644c084bca7371b9a3117107a7f69a796c6712f
-
SHA512
1a6071534de7db4d15869620a297b68b809867a1e23753b18246251869cf9d5d8561bd39d662611f49b26017a7808db9585af903b3ffbed1f5bbe0b774b58a9e
-
SSDEEP
12288:/U5rCOTeiDR+D0MO9nlWdFWUSu9rhkLarwdBJLdjw+9vNZ:/UQOJDAD2WaUX9rhkLayLdjX1N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2732 D522.tmp 3884 D5AF.tmp 3384 D6F7.tmp 4564 D774.tmp 4024 D7D2.tmp 4144 D83F.tmp 208 D88D.tmp 2696 D8DB.tmp 1476 D939.tmp 2024 D9A7.tmp 4984 D9F5.tmp 3604 DA43.tmp 4524 DAB0.tmp 1912 DB1E.tmp 4728 DB6C.tmp 4168 DBD9.tmp 1492 DC37.tmp 1744 DCB4.tmp 3476 DD12.tmp 2480 DD7F.tmp 3536 DDCD.tmp 3400 DE1B.tmp 2160 DE79.tmp 4192 DEE6.tmp 2572 DF54.tmp 3968 DFC1.tmp 5072 E03E.tmp 3924 E0AB.tmp 4004 E119.tmp 4452 E196.tmp 1652 E1F4.tmp 2092 E261.tmp 2512 E2BF.tmp 1764 E31C.tmp 4520 E37A.tmp 1752 E3D8.tmp 3036 E436.tmp 2700 E493.tmp 4512 E4E2.tmp 3272 E53F.tmp 4800 E58D.tmp 2356 E5EB.tmp 3760 E639.tmp 4332 E697.tmp 388 E6E5.tmp 5012 E743.tmp 3956 E7A1.tmp 4320 E7FE.tmp 3652 E85C.tmp 2496 E8BA.tmp 4848 E908.tmp 1044 E966.tmp 3412 E9B4.tmp 1156 EA12.tmp 1300 EA60.tmp 1608 EABE.tmp 3908 EB0C.tmp 4600 EB69.tmp 4980 EBB8.tmp 3020 EC15.tmp 4460 EC63.tmp 396 ECC1.tmp 3996 ED0F.tmp 4188 ED5D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 940 wrote to memory of 2732 940 2024-04-15_ffc1899a36f839e767607b02041eae80_mafia.exe 88 PID 940 wrote to memory of 2732 940 2024-04-15_ffc1899a36f839e767607b02041eae80_mafia.exe 88 PID 940 wrote to memory of 2732 940 2024-04-15_ffc1899a36f839e767607b02041eae80_mafia.exe 88 PID 2732 wrote to memory of 3884 2732 D522.tmp 91 PID 2732 wrote to memory of 3884 2732 D522.tmp 91 PID 2732 wrote to memory of 3884 2732 D522.tmp 91 PID 3884 wrote to memory of 3384 3884 D5AF.tmp 93 PID 3884 wrote to memory of 3384 3884 D5AF.tmp 93 PID 3884 wrote to memory of 3384 3884 D5AF.tmp 93 PID 3384 wrote to memory of 4564 3384 D6F7.tmp 94 PID 3384 wrote to memory of 4564 3384 D6F7.tmp 94 PID 3384 wrote to memory of 4564 3384 D6F7.tmp 94 PID 4564 wrote to memory of 4024 4564 D774.tmp 95 PID 4564 wrote to memory of 4024 4564 D774.tmp 95 PID 4564 wrote to memory of 4024 4564 D774.tmp 95 PID 4024 wrote to memory of 4144 4024 D7D2.tmp 96 PID 4024 wrote to memory of 4144 4024 D7D2.tmp 96 PID 4024 wrote to memory of 4144 4024 D7D2.tmp 96 PID 4144 wrote to memory of 208 4144 D83F.tmp 97 PID 4144 wrote to memory of 208 4144 D83F.tmp 97 PID 4144 wrote to memory of 208 4144 D83F.tmp 97 PID 208 wrote to memory of 2696 208 D88D.tmp 98 PID 208 wrote to memory of 2696 208 D88D.tmp 98 PID 208 wrote to memory of 2696 208 D88D.tmp 98 PID 2696 wrote to memory of 1476 2696 D8DB.tmp 99 PID 2696 wrote to memory of 1476 2696 D8DB.tmp 99 PID 2696 wrote to memory of 1476 2696 D8DB.tmp 99 PID 1476 wrote to memory of 2024 1476 D939.tmp 100 PID 1476 wrote to memory of 2024 1476 D939.tmp 100 PID 1476 wrote to memory of 2024 1476 D939.tmp 100 PID 2024 wrote to memory of 4984 2024 D9A7.tmp 101 PID 2024 wrote to memory of 4984 2024 D9A7.tmp 101 PID 2024 wrote to memory of 4984 2024 D9A7.tmp 101 PID 4984 wrote to memory of 3604 4984 D9F5.tmp 102 PID 4984 wrote to memory of 3604 4984 D9F5.tmp 102 PID 4984 wrote to memory of 3604 4984 D9F5.tmp 102 PID 3604 wrote to memory of 4524 3604 DA43.tmp 103 PID 3604 wrote to memory of 4524 3604 DA43.tmp 103 PID 3604 wrote to memory of 4524 3604 DA43.tmp 103 PID 4524 wrote to memory of 1912 4524 DAB0.tmp 104 PID 4524 wrote to memory of 1912 4524 DAB0.tmp 104 PID 4524 wrote to memory of 1912 4524 DAB0.tmp 104 PID 1912 wrote to memory of 4728 1912 DB1E.tmp 105 PID 1912 wrote to memory of 4728 1912 DB1E.tmp 105 PID 1912 wrote to memory of 4728 1912 DB1E.tmp 105 PID 4728 wrote to memory of 4168 4728 DB6C.tmp 107 PID 4728 wrote to memory of 4168 4728 DB6C.tmp 107 PID 4728 wrote to memory of 4168 4728 DB6C.tmp 107 PID 4168 wrote to memory of 1492 4168 DBD9.tmp 108 PID 4168 wrote to memory of 1492 4168 DBD9.tmp 108 PID 4168 wrote to memory of 1492 4168 DBD9.tmp 108 PID 1492 wrote to memory of 1744 1492 DC37.tmp 110 PID 1492 wrote to memory of 1744 1492 DC37.tmp 110 PID 1492 wrote to memory of 1744 1492 DC37.tmp 110 PID 1744 wrote to memory of 3476 1744 DCB4.tmp 111 PID 1744 wrote to memory of 3476 1744 DCB4.tmp 111 PID 1744 wrote to memory of 3476 1744 DCB4.tmp 111 PID 3476 wrote to memory of 2480 3476 DD12.tmp 112 PID 3476 wrote to memory of 2480 3476 DD12.tmp 112 PID 3476 wrote to memory of 2480 3476 DD12.tmp 112 PID 2480 wrote to memory of 3536 2480 DD7F.tmp 113 PID 2480 wrote to memory of 3536 2480 DD7F.tmp 113 PID 2480 wrote to memory of 3536 2480 DD7F.tmp 113 PID 3536 wrote to memory of 3400 3536 DDCD.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_ffc1899a36f839e767607b02041eae80_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_ffc1899a36f839e767607b02041eae80_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\D774.tmp"C:\Users\Admin\AppData\Local\Temp\D774.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\D83F.tmp"C:\Users\Admin\AppData\Local\Temp\D83F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\D88D.tmp"C:\Users\Admin\AppData\Local\Temp\D88D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"C:\Users\Admin\AppData\Local\Temp\D9F5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\DA43.tmp"C:\Users\Admin\AppData\Local\Temp\DA43.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\DC37.tmp"C:\Users\Admin\AppData\Local\Temp\DC37.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"23⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\DE79.tmp"C:\Users\Admin\AppData\Local\Temp\DE79.tmp"24⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"25⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"26⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"27⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"28⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"29⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\E119.tmp"C:\Users\Admin\AppData\Local\Temp\E119.tmp"30⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"31⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"32⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"33⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"34⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\E31C.tmp"C:\Users\Admin\AppData\Local\Temp\E31C.tmp"35⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"36⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"37⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\E436.tmp"C:\Users\Admin\AppData\Local\Temp\E436.tmp"38⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"39⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"40⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"41⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\E58D.tmp"C:\Users\Admin\AppData\Local\Temp\E58D.tmp"42⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"43⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"44⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\E697.tmp"C:\Users\Admin\AppData\Local\Temp\E697.tmp"45⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"46⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"47⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"48⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"49⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"50⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"51⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"52⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"53⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"54⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"55⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"56⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"57⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"58⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"59⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"60⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"61⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"62⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"63⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"64⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"65⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"66⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\EE09.tmp"C:\Users\Admin\AppData\Local\Temp\EE09.tmp"67⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"68⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"69⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\EF03.tmp"C:\Users\Admin\AppData\Local\Temp\EF03.tmp"70⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\EF61.tmp"C:\Users\Admin\AppData\Local\Temp\EF61.tmp"71⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"72⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"73⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\F05B.tmp"C:\Users\Admin\AppData\Local\Temp\F05B.tmp"74⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"75⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\F107.tmp"C:\Users\Admin\AppData\Local\Temp\F107.tmp"76⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\F165.tmp"C:\Users\Admin\AppData\Local\Temp\F165.tmp"77⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"78⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"79⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\F26E.tmp"C:\Users\Admin\AppData\Local\Temp\F26E.tmp"80⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"81⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\F32A.tmp"C:\Users\Admin\AppData\Local\Temp\F32A.tmp"82⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\F388.tmp"C:\Users\Admin\AppData\Local\Temp\F388.tmp"83⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"84⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\F433.tmp"C:\Users\Admin\AppData\Local\Temp\F433.tmp"85⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"86⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"87⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\F53D.tmp"C:\Users\Admin\AppData\Local\Temp\F53D.tmp"88⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"89⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"90⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\F637.tmp"C:\Users\Admin\AppData\Local\Temp\F637.tmp"91⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\F695.tmp"C:\Users\Admin\AppData\Local\Temp\F695.tmp"92⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"93⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"94⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"95⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"96⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\F83B.tmp"C:\Users\Admin\AppData\Local\Temp\F83B.tmp"97⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"98⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"99⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"100⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"101⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"102⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"103⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"104⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"105⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\FB48.tmp"C:\Users\Admin\AppData\Local\Temp\FB48.tmp"106⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"107⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"108⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"109⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"110⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"111⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"112⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"113⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\FE17.tmp"C:\Users\Admin\AppData\Local\Temp\FE17.tmp"114⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"115⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"116⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\FF11.tmp"C:\Users\Admin\AppData\Local\Temp\FF11.tmp"117⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"118⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"119⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"120⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"121⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"122⤵PID:4720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-