Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 18:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-27_3b69d5cfbfdb808f056769656afd96f9_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-27_3b69d5cfbfdb808f056769656afd96f9_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-04-27_3b69d5cfbfdb808f056769656afd96f9_mafia.exe
-
Size
520KB
-
MD5
3b69d5cfbfdb808f056769656afd96f9
-
SHA1
fbd92290b3f7fabbfde2a9e3140d7383974f8dd7
-
SHA256
b6e14b71a8e09195c9de2550cfa2d1d1d08daa2a571d5636e1cf113503678599
-
SHA512
fbe686acb55b6135c51395c4adc107742182219e3717368db34e72271581ffd07bed3a3b656a280ecda4b0d0ebd0cc922a450c3ce359c2eaeba2a192049836a2
-
SSDEEP
12288:roRXOQjmOytot8lq7Aryi+EccG5b2Y8YNZ:rogQ9ytoR7AIwEb2Y8YN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2836 3D3.tmp 4224 52B.tmp 5300 635.tmp 4596 71F.tmp 1976 7DB.tmp 3536 8C5.tmp 700 9BF.tmp 2016 E24.tmp 5136 EFF.tmp 5432 123B.tmp 5556 1306.tmp 2224 13A2.tmp 3376 145E.tmp 5336 1539.tmp 5396 1604.tmp 628 16BF.tmp 2212 175B.tmp 3384 1817.tmp 3080 18D2.tmp 5924 199E.tmp 5964 1A59.tmp 5984 1B15.tmp 5824 1C3D.tmp 5472 1DF3.tmp 5968 1EBE.tmp 3860 1F5A.tmp 5492 2006.tmp 3284 20F1.tmp 2316 218D.tmp 4004 2239.tmp 4256 2323.tmp 5116 23BF.tmp 1084 246B.tmp 5816 24F8.tmp 2184 2575.tmp 5788 2601.tmp 2120 269E.tmp 6068 273A.tmp 3804 27D6.tmp 2816 2863.tmp 3520 28E0.tmp 3924 295D.tmp 3848 2A09.tmp 2208 2A95.tmp 5032 2B32.tmp 1608 2BAF.tmp 3968 2C4B.tmp 5184 2CB8.tmp 5008 2D26.tmp 5796 2DB2.tmp 2776 2E3F.tmp 3480 2EBC.tmp 2832 2F29.tmp 4952 2F97.tmp 3516 3023.tmp 5784 30B0.tmp 5096 311D.tmp 3728 319A.tmp 5164 3217.tmp 1704 3294.tmp 4196 3302.tmp 1616 336F.tmp 3132 340B.tmp 872 3479.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2620 wrote to memory of 2836 2620 2024-04-27_3b69d5cfbfdb808f056769656afd96f9_mafia.exe 91 PID 2620 wrote to memory of 2836 2620 2024-04-27_3b69d5cfbfdb808f056769656afd96f9_mafia.exe 91 PID 2620 wrote to memory of 2836 2620 2024-04-27_3b69d5cfbfdb808f056769656afd96f9_mafia.exe 91 PID 2836 wrote to memory of 4224 2836 3D3.tmp 92 PID 2836 wrote to memory of 4224 2836 3D3.tmp 92 PID 2836 wrote to memory of 4224 2836 3D3.tmp 92 PID 4224 wrote to memory of 5300 4224 52B.tmp 93 PID 4224 wrote to memory of 5300 4224 52B.tmp 93 PID 4224 wrote to memory of 5300 4224 52B.tmp 93 PID 5300 wrote to memory of 4596 5300 635.tmp 94 PID 5300 wrote to memory of 4596 5300 635.tmp 94 PID 5300 wrote to memory of 4596 5300 635.tmp 94 PID 4596 wrote to memory of 1976 4596 71F.tmp 95 PID 4596 wrote to memory of 1976 4596 71F.tmp 95 PID 4596 wrote to memory of 1976 4596 71F.tmp 95 PID 1976 wrote to memory of 3536 1976 7DB.tmp 96 PID 1976 wrote to memory of 3536 1976 7DB.tmp 96 PID 1976 wrote to memory of 3536 1976 7DB.tmp 96 PID 3536 wrote to memory of 700 3536 8C5.tmp 97 PID 3536 wrote to memory of 700 3536 8C5.tmp 97 PID 3536 wrote to memory of 700 3536 8C5.tmp 97 PID 700 wrote to memory of 2016 700 9BF.tmp 98 PID 700 wrote to memory of 2016 700 9BF.tmp 98 PID 700 wrote to memory of 2016 700 9BF.tmp 98 PID 2016 wrote to memory of 5136 2016 E24.tmp 99 PID 2016 wrote to memory of 5136 2016 E24.tmp 99 PID 2016 wrote to memory of 5136 2016 E24.tmp 99 PID 5136 wrote to memory of 5432 5136 EFF.tmp 100 PID 5136 wrote to memory of 5432 5136 EFF.tmp 100 PID 5136 wrote to memory of 5432 5136 EFF.tmp 100 PID 5432 wrote to memory of 5556 5432 123B.tmp 101 PID 5432 wrote to memory of 5556 5432 123B.tmp 101 PID 5432 wrote to memory of 5556 5432 123B.tmp 101 PID 5556 wrote to memory of 2224 5556 1306.tmp 102 PID 5556 wrote to memory of 2224 5556 1306.tmp 102 PID 5556 wrote to memory of 2224 5556 1306.tmp 102 PID 2224 wrote to memory of 3376 2224 13A2.tmp 103 PID 2224 wrote to memory of 3376 2224 13A2.tmp 103 PID 2224 wrote to memory of 3376 2224 13A2.tmp 103 PID 3376 wrote to memory of 5336 3376 145E.tmp 104 PID 3376 wrote to memory of 5336 3376 145E.tmp 104 PID 3376 wrote to memory of 5336 3376 145E.tmp 104 PID 5336 wrote to memory of 5396 5336 1539.tmp 105 PID 5336 wrote to memory of 5396 5336 1539.tmp 105 PID 5336 wrote to memory of 5396 5336 1539.tmp 105 PID 5396 wrote to memory of 628 5396 1604.tmp 106 PID 5396 wrote to memory of 628 5396 1604.tmp 106 PID 5396 wrote to memory of 628 5396 1604.tmp 106 PID 628 wrote to memory of 2212 628 16BF.tmp 107 PID 628 wrote to memory of 2212 628 16BF.tmp 107 PID 628 wrote to memory of 2212 628 16BF.tmp 107 PID 2212 wrote to memory of 3384 2212 175B.tmp 108 PID 2212 wrote to memory of 3384 2212 175B.tmp 108 PID 2212 wrote to memory of 3384 2212 175B.tmp 108 PID 3384 wrote to memory of 3080 3384 1817.tmp 109 PID 3384 wrote to memory of 3080 3384 1817.tmp 109 PID 3384 wrote to memory of 3080 3384 1817.tmp 109 PID 3080 wrote to memory of 5924 3080 18D2.tmp 110 PID 3080 wrote to memory of 5924 3080 18D2.tmp 110 PID 3080 wrote to memory of 5924 3080 18D2.tmp 110 PID 5924 wrote to memory of 5964 5924 199E.tmp 111 PID 5924 wrote to memory of 5964 5924 199E.tmp 111 PID 5924 wrote to memory of 5964 5924 199E.tmp 111 PID 5964 wrote to memory of 5984 5964 1A59.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_3b69d5cfbfdb808f056769656afd96f9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_3b69d5cfbfdb808f056769656afd96f9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\3D3.tmp"C:\Users\Admin\AppData\Local\Temp\3D3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\635.tmp"C:\Users\Admin\AppData\Local\Temp\635.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\8C5.tmp"C:\Users\Admin\AppData\Local\Temp\8C5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\9BF.tmp"C:\Users\Admin\AppData\Local\Temp\9BF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\EFF.tmp"C:\Users\Admin\AppData\Local\Temp\EFF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\1306.tmp"C:\Users\Admin\AppData\Local\Temp\1306.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\145E.tmp"C:\Users\Admin\AppData\Local\Temp\145E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\1539.tmp"C:\Users\Admin\AppData\Local\Temp\1539.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\16BF.tmp"C:\Users\Admin\AppData\Local\Temp\16BF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"23⤵
- Executes dropped EXE
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"24⤵
- Executes dropped EXE
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"25⤵
- Executes dropped EXE
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"26⤵
- Executes dropped EXE
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"27⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\2006.tmp"C:\Users\Admin\AppData\Local\Temp\2006.tmp"28⤵
- Executes dropped EXE
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"29⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\218D.tmp"C:\Users\Admin\AppData\Local\Temp\218D.tmp"30⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"31⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"32⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\23BF.tmp"C:\Users\Admin\AppData\Local\Temp\23BF.tmp"33⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"34⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"35⤵
- Executes dropped EXE
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\2575.tmp"C:\Users\Admin\AppData\Local\Temp\2575.tmp"36⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\2601.tmp"C:\Users\Admin\AppData\Local\Temp\2601.tmp"37⤵
- Executes dropped EXE
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"38⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\273A.tmp"C:\Users\Admin\AppData\Local\Temp\273A.tmp"39⤵
- Executes dropped EXE
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\27D6.tmp"C:\Users\Admin\AppData\Local\Temp\27D6.tmp"40⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\2863.tmp"C:\Users\Admin\AppData\Local\Temp\2863.tmp"41⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\28E0.tmp"C:\Users\Admin\AppData\Local\Temp\28E0.tmp"42⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"43⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\2A09.tmp"C:\Users\Admin\AppData\Local\Temp\2A09.tmp"44⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\2A95.tmp"C:\Users\Admin\AppData\Local\Temp\2A95.tmp"45⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"46⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"47⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"48⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"49⤵
- Executes dropped EXE
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"50⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"51⤵
- Executes dropped EXE
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"52⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"53⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"54⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\2F97.tmp"C:\Users\Admin\AppData\Local\Temp\2F97.tmp"55⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"56⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"57⤵
- Executes dropped EXE
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\311D.tmp"C:\Users\Admin\AppData\Local\Temp\311D.tmp"58⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"59⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\3217.tmp"C:\Users\Admin\AppData\Local\Temp\3217.tmp"60⤵
- Executes dropped EXE
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\3294.tmp"C:\Users\Admin\AppData\Local\Temp\3294.tmp"61⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"62⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"63⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"64⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\3479.tmp"C:\Users\Admin\AppData\Local\Temp\3479.tmp"65⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"66⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"67⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"68⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\367C.tmp"C:\Users\Admin\AppData\Local\Temp\367C.tmp"69⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\36EA.tmp"C:\Users\Admin\AppData\Local\Temp\36EA.tmp"70⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"71⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"72⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\3880.tmp"C:\Users\Admin\AppData\Local\Temp\3880.tmp"73⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\38ED.tmp"C:\Users\Admin\AppData\Local\Temp\38ED.tmp"74⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"75⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"76⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"77⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"78⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"79⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"80⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\3C58.tmp"C:\Users\Admin\AppData\Local\Temp\3C58.tmp"81⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"82⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\3D71.tmp"C:\Users\Admin\AppData\Local\Temp\3D71.tmp"83⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"84⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"85⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\3F08.tmp"C:\Users\Admin\AppData\Local\Temp\3F08.tmp"86⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\3F94.tmp"C:\Users\Admin\AppData\Local\Temp\3F94.tmp"87⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\4021.tmp"C:\Users\Admin\AppData\Local\Temp\4021.tmp"88⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\40AE.tmp"C:\Users\Admin\AppData\Local\Temp\40AE.tmp"89⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\413A.tmp"C:\Users\Admin\AppData\Local\Temp\413A.tmp"90⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"91⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\4215.tmp"C:\Users\Admin\AppData\Local\Temp\4215.tmp"92⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\4282.tmp"C:\Users\Admin\AppData\Local\Temp\4282.tmp"93⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\42FF.tmp"C:\Users\Admin\AppData\Local\Temp\42FF.tmp"94⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\438C.tmp"C:\Users\Admin\AppData\Local\Temp\438C.tmp"95⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\4419.tmp"C:\Users\Admin\AppData\Local\Temp\4419.tmp"96⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\44B5.tmp"C:\Users\Admin\AppData\Local\Temp\44B5.tmp"97⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\4522.tmp"C:\Users\Admin\AppData\Local\Temp\4522.tmp"98⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\45AF.tmp"C:\Users\Admin\AppData\Local\Temp\45AF.tmp"99⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\461C.tmp"C:\Users\Admin\AppData\Local\Temp\461C.tmp"100⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\46C8.tmp"C:\Users\Admin\AppData\Local\Temp\46C8.tmp"101⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\4755.tmp"C:\Users\Admin\AppData\Local\Temp\4755.tmp"102⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\47D2.tmp"C:\Users\Admin\AppData\Local\Temp\47D2.tmp"103⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\484F.tmp"C:\Users\Admin\AppData\Local\Temp\484F.tmp"104⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\48DB.tmp"C:\Users\Admin\AppData\Local\Temp\48DB.tmp"105⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\4968.tmp"C:\Users\Admin\AppData\Local\Temp\4968.tmp"106⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\4A04.tmp"C:\Users\Admin\AppData\Local\Temp\4A04.tmp"107⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\4A81.tmp"C:\Users\Admin\AppData\Local\Temp\4A81.tmp"108⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"109⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"110⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\4C66.tmp"C:\Users\Admin\AppData\Local\Temp\4C66.tmp"111⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"112⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\4D50.tmp"C:\Users\Admin\AppData\Local\Temp\4D50.tmp"113⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\4DEC.tmp"C:\Users\Admin\AppData\Local\Temp\4DEC.tmp"114⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\4E98.tmp"C:\Users\Admin\AppData\Local\Temp\4E98.tmp"115⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\4F15.tmp"C:\Users\Admin\AppData\Local\Temp\4F15.tmp"116⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\4F92.tmp"C:\Users\Admin\AppData\Local\Temp\4F92.tmp"117⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"118⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\509C.tmp"C:\Users\Admin\AppData\Local\Temp\509C.tmp"119⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\5119.tmp"C:\Users\Admin\AppData\Local\Temp\5119.tmp"120⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\51A5.tmp"C:\Users\Admin\AppData\Local\Temp\51A5.tmp"121⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\5222.tmp"C:\Users\Admin\AppData\Local\Temp\5222.tmp"122⤵PID:1852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-