Analysis
-
max time kernel
153s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2024 13:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe
-
Size
520KB
-
MD5
17b2d49e001a7188b5a3cffbefeb0be7
-
SHA1
78b93dee437f6760612594c7e8059ce34c54a90d
-
SHA256
bfc437b878184e0db9482ebecc2ada1f60addbd54eef8f083bd4f7b55efa296e
-
SHA512
ccb965749bdae779813de0d9697a46357af32aea561e745e06e5c31285e980af031b15ad2286071c5bfb62de200d1cff75298d0a55085adf340517aff2d0d5d9
-
SSDEEP
12288:roRXOQjmOyN8I2GUYAt/2jz6etYnuEhJEpNZ:rogQ9yN4YAt/2jz6etYnuEngN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4764 FC32.tmp 4316 FDD8.tmp 816 FE94.tmp 1356 143.tmp 4920 26C.tmp 984 328.tmp 3228 422.tmp 3884 4FC.tmp 3244 5E7.tmp 3004 700.tmp 1528 848.tmp 3276 923.tmp 3480 A1D.tmp 488 AF8.tmp 3440 B84.tmp 4236 C30.tmp 1872 CFB.tmp 4540 E14.tmp 2656 F1E.tmp 2988 FAB.tmp 3472 1047.tmp 3976 1160.tmp 3876 11FC.tmp 3468 1299.tmp 380 1335.tmp 4868 1400.tmp 2312 1539.tmp 3964 1613.tmp 3520 16EE.tmp 3248 179A.tmp 1768 1836.tmp 2228 1901.tmp 1692 199E.tmp 4312 1A1B.tmp 3704 1AA7.tmp 1732 1B43.tmp 4348 1BC0.tmp 2448 1C2E.tmp 4132 1CAB.tmp 4448 1D28.tmp 3776 1D95.tmp 2464 1E31.tmp 4160 1EBE.tmp 3228 1F2B.tmp 4788 1FA8.tmp 2316 2016.tmp 2768 20B2.tmp 820 213F.tmp 1764 21AC.tmp 2240 2239.tmp 2728 22A6.tmp 3256 2313.tmp 4612 23BF.tmp 3500 244C.tmp 2192 24B9.tmp 1804 2640.tmp 1780 26AD.tmp 3404 271B.tmp 2044 2788.tmp 644 2815.tmp 3308 2892.tmp 3104 28FF.tmp 3056 297C.tmp 3632 29E9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1424 wrote to memory of 4764 1424 2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe 90 PID 1424 wrote to memory of 4764 1424 2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe 90 PID 1424 wrote to memory of 4764 1424 2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe 90 PID 4764 wrote to memory of 4316 4764 FC32.tmp 91 PID 4764 wrote to memory of 4316 4764 FC32.tmp 91 PID 4764 wrote to memory of 4316 4764 FC32.tmp 91 PID 4316 wrote to memory of 816 4316 FDD8.tmp 92 PID 4316 wrote to memory of 816 4316 FDD8.tmp 92 PID 4316 wrote to memory of 816 4316 FDD8.tmp 92 PID 816 wrote to memory of 1356 816 FE94.tmp 93 PID 816 wrote to memory of 1356 816 FE94.tmp 93 PID 816 wrote to memory of 1356 816 FE94.tmp 93 PID 1356 wrote to memory of 4920 1356 143.tmp 94 PID 1356 wrote to memory of 4920 1356 143.tmp 94 PID 1356 wrote to memory of 4920 1356 143.tmp 94 PID 4920 wrote to memory of 984 4920 26C.tmp 95 PID 4920 wrote to memory of 984 4920 26C.tmp 95 PID 4920 wrote to memory of 984 4920 26C.tmp 95 PID 984 wrote to memory of 3228 984 328.tmp 96 PID 984 wrote to memory of 3228 984 328.tmp 96 PID 984 wrote to memory of 3228 984 328.tmp 96 PID 3228 wrote to memory of 3884 3228 422.tmp 97 PID 3228 wrote to memory of 3884 3228 422.tmp 97 PID 3228 wrote to memory of 3884 3228 422.tmp 97 PID 3884 wrote to memory of 3244 3884 4FC.tmp 98 PID 3884 wrote to memory of 3244 3884 4FC.tmp 98 PID 3884 wrote to memory of 3244 3884 4FC.tmp 98 PID 3244 wrote to memory of 3004 3244 5E7.tmp 99 PID 3244 wrote to memory of 3004 3244 5E7.tmp 99 PID 3244 wrote to memory of 3004 3244 5E7.tmp 99 PID 3004 wrote to memory of 1528 3004 700.tmp 100 PID 3004 wrote to memory of 1528 3004 700.tmp 100 PID 3004 wrote to memory of 1528 3004 700.tmp 100 PID 1528 wrote to memory of 3276 1528 848.tmp 101 PID 1528 wrote to memory of 3276 1528 848.tmp 101 PID 1528 wrote to memory of 3276 1528 848.tmp 101 PID 3276 wrote to memory of 3480 3276 923.tmp 102 PID 3276 wrote to memory of 3480 3276 923.tmp 102 PID 3276 wrote to memory of 3480 3276 923.tmp 102 PID 3480 wrote to memory of 488 3480 A1D.tmp 103 PID 3480 wrote to memory of 488 3480 A1D.tmp 103 PID 3480 wrote to memory of 488 3480 A1D.tmp 103 PID 488 wrote to memory of 3440 488 AF8.tmp 104 PID 488 wrote to memory of 3440 488 AF8.tmp 104 PID 488 wrote to memory of 3440 488 AF8.tmp 104 PID 3440 wrote to memory of 4236 3440 B84.tmp 105 PID 3440 wrote to memory of 4236 3440 B84.tmp 105 PID 3440 wrote to memory of 4236 3440 B84.tmp 105 PID 4236 wrote to memory of 1872 4236 C30.tmp 106 PID 4236 wrote to memory of 1872 4236 C30.tmp 106 PID 4236 wrote to memory of 1872 4236 C30.tmp 106 PID 1872 wrote to memory of 4540 1872 CFB.tmp 107 PID 1872 wrote to memory of 4540 1872 CFB.tmp 107 PID 1872 wrote to memory of 4540 1872 CFB.tmp 107 PID 4540 wrote to memory of 2656 4540 E14.tmp 108 PID 4540 wrote to memory of 2656 4540 E14.tmp 108 PID 4540 wrote to memory of 2656 4540 E14.tmp 108 PID 2656 wrote to memory of 2988 2656 F1E.tmp 109 PID 2656 wrote to memory of 2988 2656 F1E.tmp 109 PID 2656 wrote to memory of 2988 2656 F1E.tmp 109 PID 2988 wrote to memory of 3472 2988 FAB.tmp 110 PID 2988 wrote to memory of 3472 2988 FAB.tmp 110 PID 2988 wrote to memory of 3472 2988 FAB.tmp 110 PID 3472 wrote to memory of 3976 3472 1047.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_17b2d49e001a7188b5a3cffbefeb0be7_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\FC32.tmp"C:\Users\Admin\AppData\Local\Temp\FC32.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\FE94.tmp"C:\Users\Admin\AppData\Local\Temp\FE94.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\143.tmp"C:\Users\Admin\AppData\Local\Temp\143.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\422.tmp"C:\Users\Admin\AppData\Local\Temp\422.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\4FC.tmp"C:\Users\Admin\AppData\Local\Temp\4FC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\5E7.tmp"C:\Users\Admin\AppData\Local\Temp\5E7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\C30.tmp"C:\Users\Admin\AppData\Local\Temp\C30.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\CFB.tmp"C:\Users\Admin\AppData\Local\Temp\CFB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\FAB.tmp"C:\Users\Admin\AppData\Local\Temp\FAB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"23⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\11FC.tmp"C:\Users\Admin\AppData\Local\Temp\11FC.tmp"24⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"25⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"26⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"27⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\1539.tmp"C:\Users\Admin\AppData\Local\Temp\1539.tmp"28⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\1613.tmp"C:\Users\Admin\AppData\Local\Temp\1613.tmp"29⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"30⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\179A.tmp"C:\Users\Admin\AppData\Local\Temp\179A.tmp"31⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"32⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"33⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"34⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"35⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"36⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\1B43.tmp"C:\Users\Admin\AppData\Local\Temp\1B43.tmp"37⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"38⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"39⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"40⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\1D28.tmp"C:\Users\Admin\AppData\Local\Temp\1D28.tmp"41⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"42⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\1E31.tmp"C:\Users\Admin\AppData\Local\Temp\1E31.tmp"43⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"44⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"45⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"46⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\2016.tmp"C:\Users\Admin\AppData\Local\Temp\2016.tmp"47⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\20B2.tmp"C:\Users\Admin\AppData\Local\Temp\20B2.tmp"48⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"49⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\21AC.tmp"C:\Users\Admin\AppData\Local\Temp\21AC.tmp"50⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"51⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\22A6.tmp"C:\Users\Admin\AppData\Local\Temp\22A6.tmp"52⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\2313.tmp"C:\Users\Admin\AppData\Local\Temp\2313.tmp"53⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\23BF.tmp"C:\Users\Admin\AppData\Local\Temp\23BF.tmp"54⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\244C.tmp"C:\Users\Admin\AppData\Local\Temp\244C.tmp"55⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\24B9.tmp"C:\Users\Admin\AppData\Local\Temp\24B9.tmp"56⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\2640.tmp"C:\Users\Admin\AppData\Local\Temp\2640.tmp"57⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\26AD.tmp"C:\Users\Admin\AppData\Local\Temp\26AD.tmp"58⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\271B.tmp"C:\Users\Admin\AppData\Local\Temp\271B.tmp"59⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"60⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\2815.tmp"C:\Users\Admin\AppData\Local\Temp\2815.tmp"61⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\2892.tmp"C:\Users\Admin\AppData\Local\Temp\2892.tmp"62⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"63⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\297C.tmp"C:\Users\Admin\AppData\Local\Temp\297C.tmp"64⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\29E9.tmp"C:\Users\Admin\AppData\Local\Temp\29E9.tmp"65⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"66⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"67⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\2B70.tmp"C:\Users\Admin\AppData\Local\Temp\2B70.tmp"68⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"69⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"70⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"71⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\2D54.tmp"C:\Users\Admin\AppData\Local\Temp\2D54.tmp"72⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"73⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"74⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\2F39.tmp"C:\Users\Admin\AppData\Local\Temp\2F39.tmp"75⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"76⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\3071.tmp"C:\Users\Admin\AppData\Local\Temp\3071.tmp"77⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\311D.tmp"C:\Users\Admin\AppData\Local\Temp\311D.tmp"78⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"79⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\3246.tmp"C:\Users\Admin\AppData\Local\Temp\3246.tmp"80⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"81⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"82⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"83⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"84⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"85⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"86⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"87⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\368C.tmp"C:\Users\Admin\AppData\Local\Temp\368C.tmp"88⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\3709.tmp"C:\Users\Admin\AppData\Local\Temp\3709.tmp"89⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"90⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"91⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"92⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"93⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"94⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\3A64.tmp"C:\Users\Admin\AppData\Local\Temp\3A64.tmp"95⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"96⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"97⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"98⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"99⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\3D23.tmp"C:\Users\Admin\AppData\Local\Temp\3D23.tmp"100⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"101⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"102⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"103⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\3F46.tmp"C:\Users\Admin\AppData\Local\Temp\3F46.tmp"104⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"105⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\4050.tmp"C:\Users\Admin\AppData\Local\Temp\4050.tmp"106⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\40DC.tmp"C:\Users\Admin\AppData\Local\Temp\40DC.tmp"107⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\4179.tmp"C:\Users\Admin\AppData\Local\Temp\4179.tmp"108⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\41F6.tmp"C:\Users\Admin\AppData\Local\Temp\41F6.tmp"109⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\4282.tmp"C:\Users\Admin\AppData\Local\Temp\4282.tmp"110⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\431F.tmp"C:\Users\Admin\AppData\Local\Temp\431F.tmp"111⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\43CA.tmp"C:\Users\Admin\AppData\Local\Temp\43CA.tmp"112⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\4457.tmp"C:\Users\Admin\AppData\Local\Temp\4457.tmp"113⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\44C4.tmp"C:\Users\Admin\AppData\Local\Temp\44C4.tmp"114⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\4590.tmp"C:\Users\Admin\AppData\Local\Temp\4590.tmp"115⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\460D.tmp"C:\Users\Admin\AppData\Local\Temp\460D.tmp"116⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\467A.tmp"C:\Users\Admin\AppData\Local\Temp\467A.tmp"117⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\46F7.tmp"C:\Users\Admin\AppData\Local\Temp\46F7.tmp"118⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\47F1.tmp"C:\Users\Admin\AppData\Local\Temp\47F1.tmp"119⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\486E.tmp"C:\Users\Admin\AppData\Local\Temp\486E.tmp"120⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\48EB.tmp"C:\Users\Admin\AppData\Local\Temp\48EB.tmp"121⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\4978.tmp"C:\Users\Admin\AppData\Local\Temp\4978.tmp"122⤵PID:4628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-