Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 14:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-25_1e56745484320d812d03690c9abf8258_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-25_1e56745484320d812d03690c9abf8258_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-01-25_1e56745484320d812d03690c9abf8258_mafia.exe
-
Size
488KB
-
MD5
1e56745484320d812d03690c9abf8258
-
SHA1
6a6982b562ab116314fb71ee402287ba116955d7
-
SHA256
7635d61d8df8ecb9dabb29039c4272f9e8677ab2db27f2a840b6514a2b52fb0d
-
SHA512
bf9e9808aa429392defb03214df7ad48271d315611d8e73672d043ccddc6f87d894988596a66ec4215bdffd10cd337f22875d8c0aa93e9f425fa1ca6c5461f1b
-
SSDEEP
12288:/U5rCOTeiDdFXQ5ne765uFCcx9uGXmqwmNZ:/UQOJDnA5e7vFhlcmN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4348 F4D0.tmp 3660 F637.tmp 4356 F6F3.tmp 2480 1A.tmp 5020 2BA.tmp 1952 385.tmp 3268 4DD.tmp 1576 5B8.tmp 3420 693.tmp 760 76D.tmp 2064 838.tmp 1500 8F4.tmp 3252 9FE.tmp 1524 AE8.tmp 4560 BC3.tmp 4492 CBD.tmp 1424 D59.tmp 380 E05.tmp 1384 EB1.tmp 4268 F9B.tmp 3904 1028.tmp 3584 1131.tmp 1684 124B.tmp 3324 13A2.tmp 2376 144E.tmp 220 14FA.tmp 3568 1596.tmp 3724 1633.tmp 2768 16B0.tmp 1996 173C.tmp 4152 1827.tmp 3540 18D2.tmp 1864 19AD.tmp 2460 1A3A.tmp 4044 1B15.tmp 2492 1BB1.tmp 1432 1CAB.tmp 1808 1D76.tmp 2272 1DF3.tmp 3660 1E80.tmp 4924 1F1C.tmp 4424 1FB8.tmp 4888 2025.tmp 4160 20C2.tmp 3136 212F.tmp 1572 21AC.tmp 4076 2239.tmp 1884 22C5.tmp 2440 23CF.tmp 4732 246B.tmp 3232 24E8.tmp 2160 2565.tmp 1500 25D3.tmp 2548 2650.tmp 1764 26DC.tmp 408 2759.tmp 3188 27E6.tmp 4588 2853.tmp 5072 28E0.tmp 2544 295D.tmp 2444 29DA.tmp 984 2A66.tmp 1292 2AF3.tmp 2144 2B9F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 324 wrote to memory of 4348 324 2024-01-25_1e56745484320d812d03690c9abf8258_mafia.exe 88 PID 324 wrote to memory of 4348 324 2024-01-25_1e56745484320d812d03690c9abf8258_mafia.exe 88 PID 324 wrote to memory of 4348 324 2024-01-25_1e56745484320d812d03690c9abf8258_mafia.exe 88 PID 4348 wrote to memory of 3660 4348 F4D0.tmp 89 PID 4348 wrote to memory of 3660 4348 F4D0.tmp 89 PID 4348 wrote to memory of 3660 4348 F4D0.tmp 89 PID 3660 wrote to memory of 4356 3660 F637.tmp 91 PID 3660 wrote to memory of 4356 3660 F637.tmp 91 PID 3660 wrote to memory of 4356 3660 F637.tmp 91 PID 4356 wrote to memory of 2480 4356 F6F3.tmp 92 PID 4356 wrote to memory of 2480 4356 F6F3.tmp 92 PID 4356 wrote to memory of 2480 4356 F6F3.tmp 92 PID 2480 wrote to memory of 5020 2480 1A.tmp 93 PID 2480 wrote to memory of 5020 2480 1A.tmp 93 PID 2480 wrote to memory of 5020 2480 1A.tmp 93 PID 5020 wrote to memory of 1952 5020 2BA.tmp 94 PID 5020 wrote to memory of 1952 5020 2BA.tmp 94 PID 5020 wrote to memory of 1952 5020 2BA.tmp 94 PID 1952 wrote to memory of 3268 1952 385.tmp 96 PID 1952 wrote to memory of 3268 1952 385.tmp 96 PID 1952 wrote to memory of 3268 1952 385.tmp 96 PID 3268 wrote to memory of 1576 3268 4DD.tmp 97 PID 3268 wrote to memory of 1576 3268 4DD.tmp 97 PID 3268 wrote to memory of 1576 3268 4DD.tmp 97 PID 1576 wrote to memory of 3420 1576 5B8.tmp 98 PID 1576 wrote to memory of 3420 1576 5B8.tmp 98 PID 1576 wrote to memory of 3420 1576 5B8.tmp 98 PID 3420 wrote to memory of 760 3420 693.tmp 99 PID 3420 wrote to memory of 760 3420 693.tmp 99 PID 3420 wrote to memory of 760 3420 693.tmp 99 PID 760 wrote to memory of 2064 760 76D.tmp 100 PID 760 wrote to memory of 2064 760 76D.tmp 100 PID 760 wrote to memory of 2064 760 76D.tmp 100 PID 2064 wrote to memory of 1500 2064 838.tmp 101 PID 2064 wrote to memory of 1500 2064 838.tmp 101 PID 2064 wrote to memory of 1500 2064 838.tmp 101 PID 1500 wrote to memory of 3252 1500 8F4.tmp 102 PID 1500 wrote to memory of 3252 1500 8F4.tmp 102 PID 1500 wrote to memory of 3252 1500 8F4.tmp 102 PID 3252 wrote to memory of 1524 3252 9FE.tmp 103 PID 3252 wrote to memory of 1524 3252 9FE.tmp 103 PID 3252 wrote to memory of 1524 3252 9FE.tmp 103 PID 1524 wrote to memory of 4560 1524 AE8.tmp 104 PID 1524 wrote to memory of 4560 1524 AE8.tmp 104 PID 1524 wrote to memory of 4560 1524 AE8.tmp 104 PID 4560 wrote to memory of 4492 4560 BC3.tmp 105 PID 4560 wrote to memory of 4492 4560 BC3.tmp 105 PID 4560 wrote to memory of 4492 4560 BC3.tmp 105 PID 4492 wrote to memory of 1424 4492 CBD.tmp 106 PID 4492 wrote to memory of 1424 4492 CBD.tmp 106 PID 4492 wrote to memory of 1424 4492 CBD.tmp 106 PID 1424 wrote to memory of 380 1424 D59.tmp 107 PID 1424 wrote to memory of 380 1424 D59.tmp 107 PID 1424 wrote to memory of 380 1424 D59.tmp 107 PID 380 wrote to memory of 1384 380 E05.tmp 108 PID 380 wrote to memory of 1384 380 E05.tmp 108 PID 380 wrote to memory of 1384 380 E05.tmp 108 PID 1384 wrote to memory of 4268 1384 EB1.tmp 109 PID 1384 wrote to memory of 4268 1384 EB1.tmp 109 PID 1384 wrote to memory of 4268 1384 EB1.tmp 109 PID 4268 wrote to memory of 3904 4268 F9B.tmp 110 PID 4268 wrote to memory of 3904 4268 F9B.tmp 110 PID 4268 wrote to memory of 3904 4268 F9B.tmp 110 PID 3904 wrote to memory of 3584 3904 1028.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_1e56745484320d812d03690c9abf8258_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_1e56745484320d812d03690c9abf8258_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\F637.tmp"C:\Users\Admin\AppData\Local\Temp\F637.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\2BA.tmp"C:\Users\Admin\AppData\Local\Temp\2BA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\693.tmp"C:\Users\Admin\AppData\Local\Temp\693.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\76D.tmp"C:\Users\Admin\AppData\Local\Temp\76D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\8F4.tmp"C:\Users\Admin\AppData\Local\Temp\8F4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\9FE.tmp"C:\Users\Admin\AppData\Local\Temp\9FE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\AE8.tmp"C:\Users\Admin\AppData\Local\Temp\AE8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\1028.tmp"C:\Users\Admin\AppData\Local\Temp\1028.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\1131.tmp"C:\Users\Admin\AppData\Local\Temp\1131.tmp"23⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"24⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"25⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"26⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\14FA.tmp"C:\Users\Admin\AppData\Local\Temp\14FA.tmp"27⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\1596.tmp"C:\Users\Admin\AppData\Local\Temp\1596.tmp"28⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\1633.tmp"C:\Users\Admin\AppData\Local\Temp\1633.tmp"29⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\16B0.tmp"C:\Users\Admin\AppData\Local\Temp\16B0.tmp"30⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"31⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\1827.tmp"C:\Users\Admin\AppData\Local\Temp\1827.tmp"32⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"33⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"34⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"35⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"36⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"37⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"38⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"39⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\1D76.tmp"C:\Users\Admin\AppData\Local\Temp\1D76.tmp"40⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"41⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"42⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"43⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"C:\Users\Admin\AppData\Local\Temp\1FB8.tmp"44⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\2025.tmp"C:\Users\Admin\AppData\Local\Temp\2025.tmp"45⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\20C2.tmp"C:\Users\Admin\AppData\Local\Temp\20C2.tmp"46⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"47⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\21AC.tmp"C:\Users\Admin\AppData\Local\Temp\21AC.tmp"48⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"49⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"50⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\23CF.tmp"C:\Users\Admin\AppData\Local\Temp\23CF.tmp"51⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"52⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"53⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"54⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"55⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\2650.tmp"C:\Users\Admin\AppData\Local\Temp\2650.tmp"56⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\26DC.tmp"C:\Users\Admin\AppData\Local\Temp\26DC.tmp"57⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"58⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\27E6.tmp"C:\Users\Admin\AppData\Local\Temp\27E6.tmp"59⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"60⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\28E0.tmp"C:\Users\Admin\AppData\Local\Temp\28E0.tmp"61⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"62⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"63⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\2A66.tmp"C:\Users\Admin\AppData\Local\Temp\2A66.tmp"64⤵
- Executes dropped EXE
PID:984 -
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"65⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"66⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"67⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\2C89.tmp"C:\Users\Admin\AppData\Local\Temp\2C89.tmp"68⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\2D06.tmp"C:\Users\Admin\AppData\Local\Temp\2D06.tmp"69⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"70⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\2E20.tmp"C:\Users\Admin\AppData\Local\Temp\2E20.tmp"71⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"72⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"73⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"74⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"75⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\30A0.tmp"C:\Users\Admin\AppData\Local\Temp\30A0.tmp"76⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\311D.tmp"C:\Users\Admin\AppData\Local\Temp\311D.tmp"77⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"78⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\3217.tmp"C:\Users\Admin\AppData\Local\Temp\3217.tmp"79⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"80⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\3311.tmp"C:\Users\Admin\AppData\Local\Temp\3311.tmp"81⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"82⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"83⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"84⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\3515.tmp"C:\Users\Admin\AppData\Local\Temp\3515.tmp"85⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"86⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"87⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\36AB.tmp"C:\Users\Admin\AppData\Local\Temp\36AB.tmp"88⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\3747.tmp"C:\Users\Admin\AppData\Local\Temp\3747.tmp"89⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"90⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\3832.tmp"C:\Users\Admin\AppData\Local\Temp\3832.tmp"91⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"92⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\393B.tmp"C:\Users\Admin\AppData\Local\Temp\393B.tmp"93⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\39D8.tmp"C:\Users\Admin\AppData\Local\Temp\39D8.tmp"94⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\3A64.tmp"C:\Users\Admin\AppData\Local\Temp\3A64.tmp"95⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\3B10.tmp"C:\Users\Admin\AppData\Local\Temp\3B10.tmp"96⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"97⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\3C39.tmp"C:\Users\Admin\AppData\Local\Temp\3C39.tmp"98⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"99⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\3D23.tmp"C:\Users\Admin\AppData\Local\Temp\3D23.tmp"100⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"101⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"102⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"103⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\3F65.tmp"C:\Users\Admin\AppData\Local\Temp\3F65.tmp"104⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"105⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\408E.tmp"C:\Users\Admin\AppData\Local\Temp\408E.tmp"106⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\40FC.tmp"C:\Users\Admin\AppData\Local\Temp\40FC.tmp"107⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"108⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\4234.tmp"C:\Users\Admin\AppData\Local\Temp\4234.tmp"109⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\42D0.tmp"C:\Users\Admin\AppData\Local\Temp\42D0.tmp"110⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\433E.tmp"C:\Users\Admin\AppData\Local\Temp\433E.tmp"111⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\43CA.tmp"C:\Users\Admin\AppData\Local\Temp\43CA.tmp"112⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\4457.tmp"C:\Users\Admin\AppData\Local\Temp\4457.tmp"113⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\44F3.tmp"C:\Users\Admin\AppData\Local\Temp\44F3.tmp"114⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\4580.tmp"C:\Users\Admin\AppData\Local\Temp\4580.tmp"115⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\45ED.tmp"C:\Users\Admin\AppData\Local\Temp\45ED.tmp"116⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\467A.tmp"C:\Users\Admin\AppData\Local\Temp\467A.tmp"117⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\46E7.tmp"C:\Users\Admin\AppData\Local\Temp\46E7.tmp"118⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\4755.tmp"C:\Users\Admin\AppData\Local\Temp\4755.tmp"119⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\47D2.tmp"C:\Users\Admin\AppData\Local\Temp\47D2.tmp"120⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\485E.tmp"C:\Users\Admin\AppData\Local\Temp\485E.tmp"121⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\48DB.tmp"C:\Users\Admin\AppData\Local\Temp\48DB.tmp"122⤵PID:2944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-