Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 06:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-28_0fd60bdfb0b02a77da20abb53c567910_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-28_0fd60bdfb0b02a77da20abb53c567910_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-02-28_0fd60bdfb0b02a77da20abb53c567910_mafia.exe
-
Size
712KB
-
MD5
0fd60bdfb0b02a77da20abb53c567910
-
SHA1
280f672eb01788c2c2a31c26c78563d4de31c235
-
SHA256
1de5b3c2853064a507968430fd604d67ef9aa4fb626a86ca355c0641ae10dcf8
-
SHA512
36e822c1738e228e743949b1b23f5dc38e810ed083bf40342ba4b06fc821deb637f04a47acd1582adeb9b306c1eca15a85ccc8ad4268fb1c2cd7f57e30bcf546
-
SSDEEP
12288:FU5rCOTeiDZLZfCLA65euGvptA/g8pk4OAJSB5NZdCvq5TJLCvY90D8/LVBlVk7k:FUQOJDZLRJoeuGPAXyVB5NnCvq5TJLC0
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4932 3D28.tmp 1064 3DB5.tmp 3528 3E32.tmp 3928 3E9F.tmp 3852 3EED.tmp 5004 3F4B.tmp 1780 3FB8.tmp 3932 4016.tmp 3248 4064.tmp 4972 40D2.tmp 396 413F.tmp 2700 419D.tmp 2772 41FA.tmp 3948 4277.tmp 2704 42F4.tmp 448 4352.tmp 3760 43B0.tmp 2200 43FE.tmp 3372 448B.tmp 1404 44F8.tmp 2708 4546.tmp 4784 45C3.tmp 2344 4611.tmp 4628 465F.tmp 1452 46DC.tmp 4448 474A.tmp 2756 47C7.tmp 1544 4834.tmp 2252 4882.tmp 4000 48F0.tmp 4312 496D.tmp 1032 49BB.tmp 2176 4A09.tmp 752 4A57.tmp 3856 4AB5.tmp 3604 4B03.tmp 4212 4B51.tmp 2432 4BAF.tmp 648 4BFD.tmp 5064 4C4B.tmp 1456 4C99.tmp 2436 4CE7.tmp 3268 4D35.tmp 4916 4D84.tmp 2256 4DD2.tmp 4300 4E20.tmp 4772 4E6E.tmp 4504 4EBC.tmp 4476 4F0A.tmp 3492 4F58.tmp 396 4FA6.tmp 2700 5004.tmp 5016 5062.tmp 1004 50B0.tmp 4728 510E.tmp 2716 515C.tmp 3660 51AA.tmp 2056 51F8.tmp 5088 5256.tmp 820 52B4.tmp 3720 5302.tmp 4284 5350.tmp 4420 539E.tmp 4788 53EC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 368 wrote to memory of 4932 368 2024-02-28_0fd60bdfb0b02a77da20abb53c567910_mafia.exe 89 PID 368 wrote to memory of 4932 368 2024-02-28_0fd60bdfb0b02a77da20abb53c567910_mafia.exe 89 PID 368 wrote to memory of 4932 368 2024-02-28_0fd60bdfb0b02a77da20abb53c567910_mafia.exe 89 PID 4932 wrote to memory of 1064 4932 3D28.tmp 90 PID 4932 wrote to memory of 1064 4932 3D28.tmp 90 PID 4932 wrote to memory of 1064 4932 3D28.tmp 90 PID 1064 wrote to memory of 3528 1064 3DB5.tmp 92 PID 1064 wrote to memory of 3528 1064 3DB5.tmp 92 PID 1064 wrote to memory of 3528 1064 3DB5.tmp 92 PID 3528 wrote to memory of 3928 3528 3E32.tmp 94 PID 3528 wrote to memory of 3928 3528 3E32.tmp 94 PID 3528 wrote to memory of 3928 3528 3E32.tmp 94 PID 3928 wrote to memory of 3852 3928 3E9F.tmp 96 PID 3928 wrote to memory of 3852 3928 3E9F.tmp 96 PID 3928 wrote to memory of 3852 3928 3E9F.tmp 96 PID 3852 wrote to memory of 5004 3852 3EED.tmp 98 PID 3852 wrote to memory of 5004 3852 3EED.tmp 98 PID 3852 wrote to memory of 5004 3852 3EED.tmp 98 PID 5004 wrote to memory of 1780 5004 3F4B.tmp 99 PID 5004 wrote to memory of 1780 5004 3F4B.tmp 99 PID 5004 wrote to memory of 1780 5004 3F4B.tmp 99 PID 1780 wrote to memory of 3932 1780 3FB8.tmp 100 PID 1780 wrote to memory of 3932 1780 3FB8.tmp 100 PID 1780 wrote to memory of 3932 1780 3FB8.tmp 100 PID 3932 wrote to memory of 3248 3932 4016.tmp 101 PID 3932 wrote to memory of 3248 3932 4016.tmp 101 PID 3932 wrote to memory of 3248 3932 4016.tmp 101 PID 3248 wrote to memory of 4972 3248 4064.tmp 102 PID 3248 wrote to memory of 4972 3248 4064.tmp 102 PID 3248 wrote to memory of 4972 3248 4064.tmp 102 PID 4972 wrote to memory of 396 4972 40D2.tmp 103 PID 4972 wrote to memory of 396 4972 40D2.tmp 103 PID 4972 wrote to memory of 396 4972 40D2.tmp 103 PID 396 wrote to memory of 2700 396 413F.tmp 104 PID 396 wrote to memory of 2700 396 413F.tmp 104 PID 396 wrote to memory of 2700 396 413F.tmp 104 PID 2700 wrote to memory of 2772 2700 419D.tmp 105 PID 2700 wrote to memory of 2772 2700 419D.tmp 105 PID 2700 wrote to memory of 2772 2700 419D.tmp 105 PID 2772 wrote to memory of 3948 2772 41FA.tmp 106 PID 2772 wrote to memory of 3948 2772 41FA.tmp 106 PID 2772 wrote to memory of 3948 2772 41FA.tmp 106 PID 3948 wrote to memory of 2704 3948 4277.tmp 107 PID 3948 wrote to memory of 2704 3948 4277.tmp 107 PID 3948 wrote to memory of 2704 3948 4277.tmp 107 PID 2704 wrote to memory of 448 2704 42F4.tmp 108 PID 2704 wrote to memory of 448 2704 42F4.tmp 108 PID 2704 wrote to memory of 448 2704 42F4.tmp 108 PID 448 wrote to memory of 3760 448 4352.tmp 110 PID 448 wrote to memory of 3760 448 4352.tmp 110 PID 448 wrote to memory of 3760 448 4352.tmp 110 PID 3760 wrote to memory of 2200 3760 43B0.tmp 111 PID 3760 wrote to memory of 2200 3760 43B0.tmp 111 PID 3760 wrote to memory of 2200 3760 43B0.tmp 111 PID 2200 wrote to memory of 3372 2200 43FE.tmp 112 PID 2200 wrote to memory of 3372 2200 43FE.tmp 112 PID 2200 wrote to memory of 3372 2200 43FE.tmp 112 PID 3372 wrote to memory of 1404 3372 448B.tmp 113 PID 3372 wrote to memory of 1404 3372 448B.tmp 113 PID 3372 wrote to memory of 1404 3372 448B.tmp 113 PID 1404 wrote to memory of 2708 1404 44F8.tmp 114 PID 1404 wrote to memory of 2708 1404 44F8.tmp 114 PID 1404 wrote to memory of 2708 1404 44F8.tmp 114 PID 2708 wrote to memory of 4784 2708 4546.tmp 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-28_0fd60bdfb0b02a77da20abb53c567910_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-28_0fd60bdfb0b02a77da20abb53c567910_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"23⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"24⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"25⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"26⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"27⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"28⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"29⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"30⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"31⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"32⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"33⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"34⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"35⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"36⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"37⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"38⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"39⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"40⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"41⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"42⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"43⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"44⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"45⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"46⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"47⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"48⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"49⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"50⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"51⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"52⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"53⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"54⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"55⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"56⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"57⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"58⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"59⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"60⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"61⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"62⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"63⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"64⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"65⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"66⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"67⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"68⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"69⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"70⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"71⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"72⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"73⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"74⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"75⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"76⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"77⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"78⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"79⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"80⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"81⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"82⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"83⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"84⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"85⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"86⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"87⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"88⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"89⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"90⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"91⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"92⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"93⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"94⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"95⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"96⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"97⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"98⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"99⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"100⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"101⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"102⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"103⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"104⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"105⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"106⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"107⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"108⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"109⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"110⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"111⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"112⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"113⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"114⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"115⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"116⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"117⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"118⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"119⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"120⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"121⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"122⤵PID:3680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-