Analysis
-
max time kernel
127s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 13:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-19_93ebf7ffdd985b3863cd57452ae7ccee_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-19_93ebf7ffdd985b3863cd57452ae7ccee_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-04-19_93ebf7ffdd985b3863cd57452ae7ccee_mafia.exe
-
Size
541KB
-
MD5
93ebf7ffdd985b3863cd57452ae7ccee
-
SHA1
5ad09b39ccdd00c9ed9efcba0ec97f6ff1643e40
-
SHA256
a326eb8918464e1ed8de02c8f09c19deea0a8ff58077f13b0e61cffa72f14691
-
SHA512
14ef39a44e347416ac8ab40abc7b64c83b42028ffbb4791f4016dce317e4521d26db85bb887026034bc31e09324607bbe3cef6a623b34ac7d1b78361b0f27d82
-
SSDEEP
12288:UU5rCOTeifI1IA1nSz0AIXWRqKt3An2K1rZa73ctO:UUQOJfIl1HGgUJK1rU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4168 B94.tmp 3812 D2A.tmp 1616 F0E.tmp 488 FE9.tmp 3328 1160.tmp 4808 11DD.tmp 2196 124B.tmp 2356 1325.tmp 412 1393.tmp 3712 143F.tmp 1948 14BC.tmp 4780 1587.tmp 3556 1633.tmp 4468 16DE.tmp 2528 17F8.tmp 4324 1884.tmp 1656 18F2.tmp 2276 195F.tmp 2968 1A0B.tmp 972 1B24.tmp 1488 1BA1.tmp 4336 1C1E.tmp 3988 1CAB.tmp 3540 1D18.tmp 3900 1DA5.tmp 3828 1E80.tmp 1920 1F0C.tmp 2660 2045.tmp 4428 20B2.tmp 2896 215E.tmp 4060 21CB.tmp 3376 2239.tmp 3404 2381.tmp 2932 247B.tmp 1044 24E8.tmp 4040 2565.tmp 3248 2601.tmp 2104 26AD.tmp 1380 271B.tmp 4748 27B7.tmp 1964 2824.tmp 4824 28B1.tmp 4948 291E.tmp 2060 29CA.tmp 5044 2A38.tmp 3832 2AF3.tmp 4580 2B70.tmp 1704 2C0C.tmp 1948 2C7A.tmp 3028 2D16.tmp 1548 2D83.tmp 3556 2DF1.tmp 4468 2E8D.tmp 1720 2F0A.tmp 4600 2F97.tmp 976 3004.tmp 4176 3081.tmp 4216 30EE.tmp 2480 315C.tmp 1488 31C9.tmp 4436 3246.tmp 2096 32B3.tmp 2072 3330.tmp 4744 339E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 4168 2104 2024-04-19_93ebf7ffdd985b3863cd57452ae7ccee_mafia.exe 90 PID 2104 wrote to memory of 4168 2104 2024-04-19_93ebf7ffdd985b3863cd57452ae7ccee_mafia.exe 90 PID 2104 wrote to memory of 4168 2104 2024-04-19_93ebf7ffdd985b3863cd57452ae7ccee_mafia.exe 90 PID 4168 wrote to memory of 3812 4168 B94.tmp 91 PID 4168 wrote to memory of 3812 4168 B94.tmp 91 PID 4168 wrote to memory of 3812 4168 B94.tmp 91 PID 3812 wrote to memory of 1616 3812 D2A.tmp 92 PID 3812 wrote to memory of 1616 3812 D2A.tmp 92 PID 3812 wrote to memory of 1616 3812 D2A.tmp 92 PID 1616 wrote to memory of 488 1616 F0E.tmp 376 PID 1616 wrote to memory of 488 1616 F0E.tmp 376 PID 1616 wrote to memory of 488 1616 F0E.tmp 376 PID 488 wrote to memory of 3328 488 FE9.tmp 94 PID 488 wrote to memory of 3328 488 FE9.tmp 94 PID 488 wrote to memory of 3328 488 FE9.tmp 94 PID 3328 wrote to memory of 4808 3328 1160.tmp 217 PID 3328 wrote to memory of 4808 3328 1160.tmp 217 PID 3328 wrote to memory of 4808 3328 1160.tmp 217 PID 4808 wrote to memory of 2196 4808 11DD.tmp 96 PID 4808 wrote to memory of 2196 4808 11DD.tmp 96 PID 4808 wrote to memory of 2196 4808 11DD.tmp 96 PID 2196 wrote to memory of 2356 2196 124B.tmp 180 PID 2196 wrote to memory of 2356 2196 124B.tmp 180 PID 2196 wrote to memory of 2356 2196 124B.tmp 180 PID 2356 wrote to memory of 412 2356 1325.tmp 382 PID 2356 wrote to memory of 412 2356 1325.tmp 382 PID 2356 wrote to memory of 412 2356 1325.tmp 382 PID 412 wrote to memory of 3712 412 1393.tmp 99 PID 412 wrote to memory of 3712 412 1393.tmp 99 PID 412 wrote to memory of 3712 412 1393.tmp 99 PID 3712 wrote to memory of 1948 3712 143F.tmp 142 PID 3712 wrote to memory of 1948 3712 143F.tmp 142 PID 3712 wrote to memory of 1948 3712 143F.tmp 142 PID 1948 wrote to memory of 4780 1948 14BC.tmp 428 PID 1948 wrote to memory of 4780 1948 14BC.tmp 428 PID 1948 wrote to memory of 4780 1948 14BC.tmp 428 PID 4780 wrote to memory of 3556 4780 1587.tmp 302 PID 4780 wrote to memory of 3556 4780 1587.tmp 302 PID 4780 wrote to memory of 3556 4780 1587.tmp 302 PID 3556 wrote to memory of 4468 3556 1633.tmp 265 PID 3556 wrote to memory of 4468 3556 1633.tmp 265 PID 3556 wrote to memory of 4468 3556 1633.tmp 265 PID 4468 wrote to memory of 2528 4468 16DE.tmp 346 PID 4468 wrote to memory of 2528 4468 16DE.tmp 346 PID 4468 wrote to memory of 2528 4468 16DE.tmp 346 PID 2528 wrote to memory of 4324 2528 17F8.tmp 305 PID 2528 wrote to memory of 4324 2528 17F8.tmp 305 PID 2528 wrote to memory of 4324 2528 17F8.tmp 305 PID 4324 wrote to memory of 1656 4324 1884.tmp 461 PID 4324 wrote to memory of 1656 4324 1884.tmp 461 PID 4324 wrote to memory of 1656 4324 1884.tmp 461 PID 1656 wrote to memory of 2276 1656 18F2.tmp 350 PID 1656 wrote to memory of 2276 1656 18F2.tmp 350 PID 1656 wrote to memory of 2276 1656 18F2.tmp 350 PID 2276 wrote to memory of 2968 2276 195F.tmp 192 PID 2276 wrote to memory of 2968 2276 195F.tmp 192 PID 2276 wrote to memory of 2968 2276 195F.tmp 192 PID 2968 wrote to memory of 972 2968 1A0B.tmp 109 PID 2968 wrote to memory of 972 2968 1A0B.tmp 109 PID 2968 wrote to memory of 972 2968 1A0B.tmp 109 PID 972 wrote to memory of 1488 972 1B24.tmp 482 PID 972 wrote to memory of 1488 972 1B24.tmp 482 PID 972 wrote to memory of 1488 972 1B24.tmp 482 PID 1488 wrote to memory of 4336 1488 1BA1.tmp 194
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_93ebf7ffdd985b3863cd57452ae7ccee_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_93ebf7ffdd985b3863cd57452ae7ccee_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\B94.tmp"C:\Users\Admin\AppData\Local\Temp\B94.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\11DD.tmp"C:\Users\Admin\AppData\Local\Temp\11DD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\1325.tmp"C:\Users\Admin\AppData\Local\Temp\1325.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\1393.tmp"C:\Users\Admin\AppData\Local\Temp\1393.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\143F.tmp"C:\Users\Admin\AppData\Local\Temp\143F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\1587.tmp"C:\Users\Admin\AppData\Local\Temp\1587.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\1633.tmp"C:\Users\Admin\AppData\Local\Temp\1633.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\17F8.tmp"C:\Users\Admin\AppData\Local\Temp\17F8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\195F.tmp"C:\Users\Admin\AppData\Local\Temp\195F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"23⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"24⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\1D18.tmp"C:\Users\Admin\AppData\Local\Temp\1D18.tmp"25⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"26⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"27⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"28⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"29⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\20B2.tmp"C:\Users\Admin\AppData\Local\Temp\20B2.tmp"30⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\215E.tmp"C:\Users\Admin\AppData\Local\Temp\215E.tmp"31⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\21CB.tmp"C:\Users\Admin\AppData\Local\Temp\21CB.tmp"32⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"33⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\2381.tmp"C:\Users\Admin\AppData\Local\Temp\2381.tmp"34⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\247B.tmp"C:\Users\Admin\AppData\Local\Temp\247B.tmp"35⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"36⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"37⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\2601.tmp"C:\Users\Admin\AppData\Local\Temp\2601.tmp"38⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\26AD.tmp"C:\Users\Admin\AppData\Local\Temp\26AD.tmp"39⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\271B.tmp"C:\Users\Admin\AppData\Local\Temp\271B.tmp"40⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\27B7.tmp"C:\Users\Admin\AppData\Local\Temp\27B7.tmp"41⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"42⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"43⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\291E.tmp"C:\Users\Admin\AppData\Local\Temp\291E.tmp"44⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\29CA.tmp"C:\Users\Admin\AppData\Local\Temp\29CA.tmp"45⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\2A38.tmp"C:\Users\Admin\AppData\Local\Temp\2A38.tmp"46⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"47⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\2B70.tmp"C:\Users\Admin\AppData\Local\Temp\2B70.tmp"48⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"49⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"50⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\2D16.tmp"C:\Users\Admin\AppData\Local\Temp\2D16.tmp"51⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\2D83.tmp"C:\Users\Admin\AppData\Local\Temp\2D83.tmp"52⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"53⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"54⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"55⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\2F97.tmp"C:\Users\Admin\AppData\Local\Temp\2F97.tmp"56⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\3004.tmp"C:\Users\Admin\AppData\Local\Temp\3004.tmp"57⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\3081.tmp"C:\Users\Admin\AppData\Local\Temp\3081.tmp"58⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"59⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\315C.tmp"C:\Users\Admin\AppData\Local\Temp\315C.tmp"60⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\31C9.tmp"C:\Users\Admin\AppData\Local\Temp\31C9.tmp"61⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\3246.tmp"C:\Users\Admin\AppData\Local\Temp\3246.tmp"62⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\32B3.tmp"C:\Users\Admin\AppData\Local\Temp\32B3.tmp"63⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\3330.tmp"C:\Users\Admin\AppData\Local\Temp\3330.tmp"64⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"65⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"66⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"67⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"68⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"69⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\35E0.tmp"C:\Users\Admin\AppData\Local\Temp\35E0.tmp"70⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"71⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\36DA.tmp"C:\Users\Admin\AppData\Local\Temp\36DA.tmp"72⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\3747.tmp"C:\Users\Admin\AppData\Local\Temp\3747.tmp"73⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"74⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\3822.tmp"C:\Users\Admin\AppData\Local\Temp\3822.tmp"75⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\389F.tmp"C:\Users\Admin\AppData\Local\Temp\389F.tmp"76⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"77⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"78⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"79⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\3A64.tmp"C:\Users\Admin\AppData\Local\Temp\3A64.tmp"80⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"81⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"82⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"83⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\3C39.tmp"C:\Users\Admin\AppData\Local\Temp\3C39.tmp"84⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"85⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\3D14.tmp"C:\Users\Admin\AppData\Local\Temp\3D14.tmp"86⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\3D71.tmp"C:\Users\Admin\AppData\Local\Temp\3D71.tmp"87⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"88⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"89⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"90⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\3F65.tmp"C:\Users\Admin\AppData\Local\Temp\3F65.tmp"91⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"92⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\4040.tmp"C:\Users\Admin\AppData\Local\Temp\4040.tmp"93⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\409E.tmp"C:\Users\Admin\AppData\Local\Temp\409E.tmp"94⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\410B.tmp"C:\Users\Admin\AppData\Local\Temp\410B.tmp"95⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\4169.tmp"C:\Users\Admin\AppData\Local\Temp\4169.tmp"96⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\41D6.tmp"C:\Users\Admin\AppData\Local\Temp\41D6.tmp"97⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\4244.tmp"C:\Users\Admin\AppData\Local\Temp\4244.tmp"98⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\42C1.tmp"C:\Users\Admin\AppData\Local\Temp\42C1.tmp"99⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"100⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\439C.tmp"C:\Users\Admin\AppData\Local\Temp\439C.tmp"101⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"102⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\4476.tmp"C:\Users\Admin\AppData\Local\Temp\4476.tmp"103⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\4513.tmp"C:\Users\Admin\AppData\Local\Temp\4513.tmp"104⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\4580.tmp"C:\Users\Admin\AppData\Local\Temp\4580.tmp"105⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\45DE.tmp"C:\Users\Admin\AppData\Local\Temp\45DE.tmp"106⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\464B.tmp"C:\Users\Admin\AppData\Local\Temp\464B.tmp"107⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\483F.tmp"C:\Users\Admin\AppData\Local\Temp\483F.tmp"108⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\4A62.tmp"C:\Users\Admin\AppData\Local\Temp\4A62.tmp"109⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"110⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"111⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"112⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\4C46.tmp"C:\Users\Admin\AppData\Local\Temp\4C46.tmp"113⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"114⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\4D40.tmp"C:\Users\Admin\AppData\Local\Temp\4D40.tmp"115⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\4E88.tmp"C:\Users\Admin\AppData\Local\Temp\4E88.tmp"116⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"117⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\4F63.tmp"C:\Users\Admin\AppData\Local\Temp\4F63.tmp"118⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"119⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\51B5.tmp"C:\Users\Admin\AppData\Local\Temp\51B5.tmp"120⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\5261.tmp"C:\Users\Admin\AppData\Local\Temp\5261.tmp"121⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\52BF.tmp"C:\Users\Admin\AppData\Local\Temp\52BF.tmp"122⤵PID:4808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-