Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2024, 12:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-09_280f350620f70bd6beb65f3ab3fea79b_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-09_280f350620f70bd6beb65f3ab3fea79b_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-03-09_280f350620f70bd6beb65f3ab3fea79b_mafia.exe
-
Size
527KB
-
MD5
280f350620f70bd6beb65f3ab3fea79b
-
SHA1
fd9e79ddeffd4df3ea84fb1438f481be4368f694
-
SHA256
250adac3926de7ed576c9945af4e7b8e1b8cf2f5c7d9c0b8bbfe122bcb2944e0
-
SHA512
018a0e3035159412dcd57fb3d47093c1a4e1451c73286dc80482e6ecc34db60a37807041a9a528e5e4cde8f67d0697ff6cecd7d63780fb8d0dd09906fdf7a15f
-
SSDEEP
12288:fU5rCOTeidNgaJqB7dNIw/RkR4SD4eCrsPhGDZu:fUQOJdNvcBhLBSD4eCtDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4312 38B3.tmp 3440 3911.tmp 1292 397F.tmp 3052 39FC.tmp 1036 3A4A.tmp 4276 3A98.tmp 4048 3AF6.tmp 4420 3B44.tmp 2056 3BA1.tmp 4916 3BFF.tmp 2356 3C4D.tmp 4316 3CBB.tmp 4080 3D18.tmp 400 3D67.tmp 940 3DD4.tmp 4804 3E22.tmp 3964 3E8F.tmp 3848 3F0C.tmp 1892 3F7A.tmp 4596 4006.tmp 528 4074.tmp 1180 40E1.tmp 924 413F.tmp 4988 41BC.tmp 1528 4239.tmp 452 42B6.tmp 4528 4323.tmp 3756 4371.tmp 1908 43CF.tmp 4132 443D.tmp 1984 44AA.tmp 920 44F8.tmp 2108 45C3.tmp 3240 4631.tmp 1916 467F.tmp 3176 46CD.tmp 3852 471B.tmp 2908 4769.tmp 4472 47C7.tmp 540 4815.tmp 340 4863.tmp 3976 48B1.tmp 4420 48FF.tmp 4956 494D.tmp 2576 499C.tmp 3732 49EA.tmp 3204 4A38.tmp 1320 4A96.tmp 1444 4AE4.tmp 400 4B32.tmp 1264 4B80.tmp 1624 4BCE.tmp 5068 4C1C.tmp 3848 4C7A.tmp 4764 4CC8.tmp 3324 4D16.tmp 3660 4D64.tmp 5044 4DB2.tmp 388 4E01.tmp 924 4E5E.tmp 4772 4EBC.tmp 4500 4F0A.tmp 1784 4F68.tmp 4112 4FB6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2108 wrote to memory of 4312 2108 2024-03-09_280f350620f70bd6beb65f3ab3fea79b_mafia.exe 90 PID 2108 wrote to memory of 4312 2108 2024-03-09_280f350620f70bd6beb65f3ab3fea79b_mafia.exe 90 PID 2108 wrote to memory of 4312 2108 2024-03-09_280f350620f70bd6beb65f3ab3fea79b_mafia.exe 90 PID 4312 wrote to memory of 3440 4312 38B3.tmp 91 PID 4312 wrote to memory of 3440 4312 38B3.tmp 91 PID 4312 wrote to memory of 3440 4312 38B3.tmp 91 PID 3440 wrote to memory of 1292 3440 3911.tmp 92 PID 3440 wrote to memory of 1292 3440 3911.tmp 92 PID 3440 wrote to memory of 1292 3440 3911.tmp 92 PID 1292 wrote to memory of 3052 1292 397F.tmp 94 PID 1292 wrote to memory of 3052 1292 397F.tmp 94 PID 1292 wrote to memory of 3052 1292 397F.tmp 94 PID 3052 wrote to memory of 1036 3052 39FC.tmp 96 PID 3052 wrote to memory of 1036 3052 39FC.tmp 96 PID 3052 wrote to memory of 1036 3052 39FC.tmp 96 PID 1036 wrote to memory of 4276 1036 3A4A.tmp 97 PID 1036 wrote to memory of 4276 1036 3A4A.tmp 97 PID 1036 wrote to memory of 4276 1036 3A4A.tmp 97 PID 4276 wrote to memory of 4048 4276 3A98.tmp 98 PID 4276 wrote to memory of 4048 4276 3A98.tmp 98 PID 4276 wrote to memory of 4048 4276 3A98.tmp 98 PID 4048 wrote to memory of 4420 4048 3AF6.tmp 99 PID 4048 wrote to memory of 4420 4048 3AF6.tmp 99 PID 4048 wrote to memory of 4420 4048 3AF6.tmp 99 PID 4420 wrote to memory of 2056 4420 3B44.tmp 100 PID 4420 wrote to memory of 2056 4420 3B44.tmp 100 PID 4420 wrote to memory of 2056 4420 3B44.tmp 100 PID 2056 wrote to memory of 4916 2056 3BA1.tmp 101 PID 2056 wrote to memory of 4916 2056 3BA1.tmp 101 PID 2056 wrote to memory of 4916 2056 3BA1.tmp 101 PID 4916 wrote to memory of 2356 4916 3BFF.tmp 102 PID 4916 wrote to memory of 2356 4916 3BFF.tmp 102 PID 4916 wrote to memory of 2356 4916 3BFF.tmp 102 PID 2356 wrote to memory of 4316 2356 3C4D.tmp 103 PID 2356 wrote to memory of 4316 2356 3C4D.tmp 103 PID 2356 wrote to memory of 4316 2356 3C4D.tmp 103 PID 4316 wrote to memory of 4080 4316 3CBB.tmp 104 PID 4316 wrote to memory of 4080 4316 3CBB.tmp 104 PID 4316 wrote to memory of 4080 4316 3CBB.tmp 104 PID 4080 wrote to memory of 400 4080 3D18.tmp 105 PID 4080 wrote to memory of 400 4080 3D18.tmp 105 PID 4080 wrote to memory of 400 4080 3D18.tmp 105 PID 400 wrote to memory of 940 400 3D67.tmp 106 PID 400 wrote to memory of 940 400 3D67.tmp 106 PID 400 wrote to memory of 940 400 3D67.tmp 106 PID 940 wrote to memory of 4804 940 3DD4.tmp 107 PID 940 wrote to memory of 4804 940 3DD4.tmp 107 PID 940 wrote to memory of 4804 940 3DD4.tmp 107 PID 4804 wrote to memory of 3964 4804 3E22.tmp 108 PID 4804 wrote to memory of 3964 4804 3E22.tmp 108 PID 4804 wrote to memory of 3964 4804 3E22.tmp 108 PID 3964 wrote to memory of 3848 3964 3E8F.tmp 109 PID 3964 wrote to memory of 3848 3964 3E8F.tmp 109 PID 3964 wrote to memory of 3848 3964 3E8F.tmp 109 PID 3848 wrote to memory of 1892 3848 3F0C.tmp 110 PID 3848 wrote to memory of 1892 3848 3F0C.tmp 110 PID 3848 wrote to memory of 1892 3848 3F0C.tmp 110 PID 1892 wrote to memory of 4596 1892 3F7A.tmp 111 PID 1892 wrote to memory of 4596 1892 3F7A.tmp 111 PID 1892 wrote to memory of 4596 1892 3F7A.tmp 111 PID 4596 wrote to memory of 528 4596 4006.tmp 112 PID 4596 wrote to memory of 528 4596 4006.tmp 112 PID 4596 wrote to memory of 528 4596 4006.tmp 112 PID 528 wrote to memory of 1180 528 4074.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-09_280f350620f70bd6beb65f3ab3fea79b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-09_280f350620f70bd6beb65f3ab3fea79b_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\38B3.tmp"C:\Users\Admin\AppData\Local\Temp\38B3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\397F.tmp"C:\Users\Admin\AppData\Local\Temp\397F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"23⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"24⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"25⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"26⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"27⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"28⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"29⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\43CF.tmp"C:\Users\Admin\AppData\Local\Temp\43CF.tmp"30⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"31⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"32⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"33⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"34⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"35⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"36⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"37⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"38⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"39⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"40⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"41⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"42⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"43⤵
- Executes dropped EXE
PID:340 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"44⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"45⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"46⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"47⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"48⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"49⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"50⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"51⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"52⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"53⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"54⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"55⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"56⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"57⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"58⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"59⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"60⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"61⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"62⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"63⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"64⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"65⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"66⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"67⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"68⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"69⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"70⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"71⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"72⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"73⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"74⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"75⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"76⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"77⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"78⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"79⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"80⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"81⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"82⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"83⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"84⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"85⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"86⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"87⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"88⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"89⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"90⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"91⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"92⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"93⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"94⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"95⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"96⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"97⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"98⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"99⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"100⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"101⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"102⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"103⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"104⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"105⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"106⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"107⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"108⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"109⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"110⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"111⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"112⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"113⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"114⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"115⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"116⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"117⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"118⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"119⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"120⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"121⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"122⤵PID:1088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-