Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 17:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-30_f3baa6491471d76b9115a3da0bd9640b_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-30_f3baa6491471d76b9115a3da0bd9640b_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-30_f3baa6491471d76b9115a3da0bd9640b_mafia.exe
-
Size
536KB
-
MD5
f3baa6491471d76b9115a3da0bd9640b
-
SHA1
4aa99ecd5974db343260538a6b2faad35c2fdb55
-
SHA256
9d5f1f306d4c32f353b63f3047726d0c98798f963c82409359b2ce16471457c5
-
SHA512
4cd3ee79c8bc321a4597b001d6447748215e468fdadfde15bcaa4092528bae305cc2005cd80eb5de4b1bc16e990cebab12a5abf7566bb667e2caf1116454140d
-
SSDEEP
12288:wU5rCOTeiU8CMGr4tKzf1bzf76vivkrsIZxVJ0ZT9:wUQOJU8CTY2Nzf76Ek4IRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2416 EF80.tmp 2236 F165.tmp 3392 F26E.tmp 1132 F3D6.tmp 2184 F4EF.tmp 1104 B7.tmp 4444 2F9.tmp 1688 3F3.tmp 1636 52B.tmp 1100 683.tmp 4048 7CB.tmp 2204 8F4.tmp 760 A1D.tmp 1188 BB3.tmp 5048 C9D.tmp 2888 DE6.tmp 4472 EEF.tmp 4584 FE9.tmp 3280 1151.tmp 924 126A.tmp 1372 1345.tmp 976 147D.tmp 4068 1577.tmp 4480 1652.tmp 2820 177B.tmp 3420 1901.tmp 1040 1A2A.tmp 4968 1B24.tmp 1972 1C4D.tmp 4352 1D57.tmp 4420 1EED.tmp 5104 2035.tmp 2892 21CB.tmp 1744 22B6.tmp 1860 2371.tmp 1432 246B.tmp 440 2556.tmp 1184 2611.tmp 4508 26EC.tmp 3112 2815.tmp 4444 28B1.tmp 2936 29AB.tmp 1992 2AC4.tmp 3876 2B8F.tmp 4048 2C3B.tmp 1172 2CE7.tmp 760 2E4E.tmp 5108 2F1A.tmp 3992 2FC5.tmp 1900 3052.tmp 2144 30DF.tmp 2312 319A.tmp 1596 3217.tmp 4060 3294.tmp 700 3302.tmp 3740 33BD.tmp 4560 344A.tmp 2304 34C7.tmp 3208 3534.tmp 1500 35D0.tmp 4952 368C.tmp 628 3728.tmp 3292 37C4.tmp 3940 3832.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4848 wrote to memory of 2416 4848 2024-04-30_f3baa6491471d76b9115a3da0bd9640b_mafia.exe 90 PID 4848 wrote to memory of 2416 4848 2024-04-30_f3baa6491471d76b9115a3da0bd9640b_mafia.exe 90 PID 4848 wrote to memory of 2416 4848 2024-04-30_f3baa6491471d76b9115a3da0bd9640b_mafia.exe 90 PID 2416 wrote to memory of 2236 2416 EF80.tmp 91 PID 2416 wrote to memory of 2236 2416 EF80.tmp 91 PID 2416 wrote to memory of 2236 2416 EF80.tmp 91 PID 2236 wrote to memory of 3392 2236 F165.tmp 92 PID 2236 wrote to memory of 3392 2236 F165.tmp 92 PID 2236 wrote to memory of 3392 2236 F165.tmp 92 PID 3392 wrote to memory of 1132 3392 F26E.tmp 93 PID 3392 wrote to memory of 1132 3392 F26E.tmp 93 PID 3392 wrote to memory of 1132 3392 F26E.tmp 93 PID 1132 wrote to memory of 2184 1132 F3D6.tmp 94 PID 1132 wrote to memory of 2184 1132 F3D6.tmp 94 PID 1132 wrote to memory of 2184 1132 F3D6.tmp 94 PID 2184 wrote to memory of 1104 2184 F4EF.tmp 95 PID 2184 wrote to memory of 1104 2184 F4EF.tmp 95 PID 2184 wrote to memory of 1104 2184 F4EF.tmp 95 PID 1104 wrote to memory of 4444 1104 B7.tmp 96 PID 1104 wrote to memory of 4444 1104 B7.tmp 96 PID 1104 wrote to memory of 4444 1104 B7.tmp 96 PID 4444 wrote to memory of 1688 4444 2F9.tmp 97 PID 4444 wrote to memory of 1688 4444 2F9.tmp 97 PID 4444 wrote to memory of 1688 4444 2F9.tmp 97 PID 1688 wrote to memory of 1636 1688 3F3.tmp 98 PID 1688 wrote to memory of 1636 1688 3F3.tmp 98 PID 1688 wrote to memory of 1636 1688 3F3.tmp 98 PID 1636 wrote to memory of 1100 1636 52B.tmp 99 PID 1636 wrote to memory of 1100 1636 52B.tmp 99 PID 1636 wrote to memory of 1100 1636 52B.tmp 99 PID 1100 wrote to memory of 4048 1100 683.tmp 100 PID 1100 wrote to memory of 4048 1100 683.tmp 100 PID 1100 wrote to memory of 4048 1100 683.tmp 100 PID 4048 wrote to memory of 2204 4048 7CB.tmp 101 PID 4048 wrote to memory of 2204 4048 7CB.tmp 101 PID 4048 wrote to memory of 2204 4048 7CB.tmp 101 PID 2204 wrote to memory of 760 2204 8F4.tmp 102 PID 2204 wrote to memory of 760 2204 8F4.tmp 102 PID 2204 wrote to memory of 760 2204 8F4.tmp 102 PID 760 wrote to memory of 1188 760 A1D.tmp 103 PID 760 wrote to memory of 1188 760 A1D.tmp 103 PID 760 wrote to memory of 1188 760 A1D.tmp 103 PID 1188 wrote to memory of 5048 1188 BB3.tmp 104 PID 1188 wrote to memory of 5048 1188 BB3.tmp 104 PID 1188 wrote to memory of 5048 1188 BB3.tmp 104 PID 5048 wrote to memory of 2888 5048 C9D.tmp 105 PID 5048 wrote to memory of 2888 5048 C9D.tmp 105 PID 5048 wrote to memory of 2888 5048 C9D.tmp 105 PID 2888 wrote to memory of 4472 2888 DE6.tmp 106 PID 2888 wrote to memory of 4472 2888 DE6.tmp 106 PID 2888 wrote to memory of 4472 2888 DE6.tmp 106 PID 4472 wrote to memory of 4584 4472 EEF.tmp 107 PID 4472 wrote to memory of 4584 4472 EEF.tmp 107 PID 4472 wrote to memory of 4584 4472 EEF.tmp 107 PID 4584 wrote to memory of 3280 4584 FE9.tmp 108 PID 4584 wrote to memory of 3280 4584 FE9.tmp 108 PID 4584 wrote to memory of 3280 4584 FE9.tmp 108 PID 3280 wrote to memory of 924 3280 1151.tmp 109 PID 3280 wrote to memory of 924 3280 1151.tmp 109 PID 3280 wrote to memory of 924 3280 1151.tmp 109 PID 924 wrote to memory of 1372 924 126A.tmp 110 PID 924 wrote to memory of 1372 924 126A.tmp 110 PID 924 wrote to memory of 1372 924 126A.tmp 110 PID 1372 wrote to memory of 976 1372 1345.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_f3baa6491471d76b9115a3da0bd9640b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_f3baa6491471d76b9115a3da0bd9640b_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\EF80.tmp"C:\Users\Admin\AppData\Local\Temp\EF80.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\F165.tmp"C:\Users\Admin\AppData\Local\Temp\F165.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\F26E.tmp"C:\Users\Admin\AppData\Local\Temp\F26E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\7CB.tmp"C:\Users\Admin\AppData\Local\Temp\7CB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\8F4.tmp"C:\Users\Admin\AppData\Local\Temp\8F4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\126A.tmp"C:\Users\Admin\AppData\Local\Temp\126A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\1345.tmp"C:\Users\Admin\AppData\Local\Temp\1345.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"23⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"24⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"25⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"26⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"27⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"28⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"29⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"30⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\1D57.tmp"C:\Users\Admin\AppData\Local\Temp\1D57.tmp"31⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\1EED.tmp"C:\Users\Admin\AppData\Local\Temp\1EED.tmp"32⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\2035.tmp"C:\Users\Admin\AppData\Local\Temp\2035.tmp"33⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\21CB.tmp"C:\Users\Admin\AppData\Local\Temp\21CB.tmp"34⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\22B6.tmp"C:\Users\Admin\AppData\Local\Temp\22B6.tmp"35⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\2371.tmp"C:\Users\Admin\AppData\Local\Temp\2371.tmp"36⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"37⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\2556.tmp"C:\Users\Admin\AppData\Local\Temp\2556.tmp"38⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\2611.tmp"C:\Users\Admin\AppData\Local\Temp\2611.tmp"39⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"40⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\2815.tmp"C:\Users\Admin\AppData\Local\Temp\2815.tmp"41⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"42⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\29AB.tmp"C:\Users\Admin\AppData\Local\Temp\29AB.tmp"43⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"44⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"45⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"46⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"47⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"48⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"49⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"50⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"51⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\30DF.tmp"C:\Users\Admin\AppData\Local\Temp\30DF.tmp"52⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"53⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\3217.tmp"C:\Users\Admin\AppData\Local\Temp\3217.tmp"54⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\3294.tmp"C:\Users\Admin\AppData\Local\Temp\3294.tmp"55⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"56⤵
- Executes dropped EXE
PID:700 -
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"57⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"58⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\34C7.tmp"C:\Users\Admin\AppData\Local\Temp\34C7.tmp"59⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"60⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"61⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\368C.tmp"C:\Users\Admin\AppData\Local\Temp\368C.tmp"62⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\3728.tmp"C:\Users\Admin\AppData\Local\Temp\3728.tmp"63⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\37C4.tmp"C:\Users\Admin\AppData\Local\Temp\37C4.tmp"64⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\3832.tmp"C:\Users\Admin\AppData\Local\Temp\3832.tmp"65⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\38ED.tmp"C:\Users\Admin\AppData\Local\Temp\38ED.tmp"66⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"67⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\39F7.tmp"C:\Users\Admin\AppData\Local\Temp\39F7.tmp"68⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\3A83.tmp"C:\Users\Admin\AppData\Local\Temp\3A83.tmp"69⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\3B00.tmp"C:\Users\Admin\AppData\Local\Temp\3B00.tmp"70⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"71⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"72⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"73⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\3D04.tmp"C:\Users\Admin\AppData\Local\Temp\3D04.tmp"74⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\3D71.tmp"C:\Users\Admin\AppData\Local\Temp\3D71.tmp"75⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"76⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"77⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"78⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\3F56.tmp"C:\Users\Admin\AppData\Local\Temp\3F56.tmp"79⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"80⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\4040.tmp"C:\Users\Admin\AppData\Local\Temp\4040.tmp"81⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\40AE.tmp"C:\Users\Admin\AppData\Local\Temp\40AE.tmp"82⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\411B.tmp"C:\Users\Admin\AppData\Local\Temp\411B.tmp"83⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\4198.tmp"C:\Users\Admin\AppData\Local\Temp\4198.tmp"84⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\4215.tmp"C:\Users\Admin\AppData\Local\Temp\4215.tmp"85⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\4282.tmp"C:\Users\Admin\AppData\Local\Temp\4282.tmp"86⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\42FF.tmp"C:\Users\Admin\AppData\Local\Temp\42FF.tmp"87⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\438C.tmp"C:\Users\Admin\AppData\Local\Temp\438C.tmp"88⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\43F9.tmp"C:\Users\Admin\AppData\Local\Temp\43F9.tmp"89⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\44B5.tmp"C:\Users\Admin\AppData\Local\Temp\44B5.tmp"90⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\4532.tmp"C:\Users\Admin\AppData\Local\Temp\4532.tmp"91⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\459F.tmp"C:\Users\Admin\AppData\Local\Temp\459F.tmp"92⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\461C.tmp"C:\Users\Admin\AppData\Local\Temp\461C.tmp"93⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\46B8.tmp"C:\Users\Admin\AppData\Local\Temp\46B8.tmp"94⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\4745.tmp"C:\Users\Admin\AppData\Local\Temp\4745.tmp"95⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\47C2.tmp"C:\Users\Admin\AppData\Local\Temp\47C2.tmp"96⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\483F.tmp"C:\Users\Admin\AppData\Local\Temp\483F.tmp"97⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\48BC.tmp"C:\Users\Admin\AppData\Local\Temp\48BC.tmp"98⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\491A.tmp"C:\Users\Admin\AppData\Local\Temp\491A.tmp"99⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\49A6.tmp"C:\Users\Admin\AppData\Local\Temp\49A6.tmp"100⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\4A14.tmp"C:\Users\Admin\AppData\Local\Temp\4A14.tmp"101⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\4A91.tmp"C:\Users\Admin\AppData\Local\Temp\4A91.tmp"102⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"103⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"104⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\4C27.tmp"C:\Users\Admin\AppData\Local\Temp\4C27.tmp"105⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"106⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\4D21.tmp"C:\Users\Admin\AppData\Local\Temp\4D21.tmp"107⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"108⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"109⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\4E88.tmp"C:\Users\Admin\AppData\Local\Temp\4E88.tmp"110⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"111⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\4F73.tmp"C:\Users\Admin\AppData\Local\Temp\4F73.tmp"112⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"113⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\507C.tmp"C:\Users\Admin\AppData\Local\Temp\507C.tmp"114⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\5119.tmp"C:\Users\Admin\AppData\Local\Temp\5119.tmp"115⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\51B5.tmp"C:\Users\Admin\AppData\Local\Temp\51B5.tmp"116⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\5222.tmp"C:\Users\Admin\AppData\Local\Temp\5222.tmp"117⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\52AF.tmp"C:\Users\Admin\AppData\Local\Temp\52AF.tmp"118⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\532C.tmp"C:\Users\Admin\AppData\Local\Temp\532C.tmp"119⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\53B9.tmp"C:\Users\Admin\AppData\Local\Temp\53B9.tmp"120⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\5445.tmp"C:\Users\Admin\AppData\Local\Temp\5445.tmp"121⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\54B3.tmp"C:\Users\Admin\AppData\Local\Temp\54B3.tmp"122⤵PID:1300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-