Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-03-2024 01:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-10_3b3e281cc0dc0d9b4f2773e1a9f43918_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-10_3b3e281cc0dc0d9b4f2773e1a9f43918_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-03-10_3b3e281cc0dc0d9b4f2773e1a9f43918_mafia.exe
-
Size
486KB
-
MD5
3b3e281cc0dc0d9b4f2773e1a9f43918
-
SHA1
e6307da6ea5ae9a6c97e8342ec4de4a52ae9c99f
-
SHA256
64beb421995799dd090f461f2d3f40c3701850822db851db3b193c480bd4b62c
-
SHA512
d109fb40c7515e779148ef016b46b567c9981ef705608f94a4d624b43abf3f073dbe2b54783d96cd331624a349fe8677e74069b1388fcdca92d469e1d8841428
-
SSDEEP
12288:UU5rCOTeiDws02jqQUk+ogWH4DUBNHmwNhCNZ:UUQOJDLjDUfCGQhNwN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3064 36DF.tmp 1132 375C.tmp 1184 37D9.tmp 1604 3846.tmp 5516 38C3.tmp 4356 3940.tmp 4000 399E.tmp 5320 39FC.tmp 6064 3A59.tmp 4520 3AC7.tmp 5240 3B15.tmp 4864 3B73.tmp 5452 3BE0.tmp 4832 3C5D.tmp 2612 3CCA.tmp 4448 3D38.tmp 3300 3D86.tmp 3052 3DE4.tmp 440 3E41.tmp 2116 3E8F.tmp 1624 3EFD.tmp 3320 3F6A.tmp 428 3FB8.tmp 1900 4026.tmp 2292 4074.tmp 1280 40F1.tmp 6124 416E.tmp 4372 41CC.tmp 2704 4239.tmp 5232 42A6.tmp 4296 4314.tmp 668 4391.tmp 4112 43DF.tmp 5108 442D.tmp 3240 447B.tmp 5432 44C9.tmp 4124 4546.tmp 4948 4594.tmp 3436 45E2.tmp 3724 4640.tmp 4932 468E.tmp 2556 46DC.tmp 3544 472B.tmp 1136 4788.tmp 1384 47D6.tmp 2144 4825.tmp 1268 4873.tmp 4704 48D0.tmp 4676 492E.tmp 5620 497C.tmp 2264 49CA.tmp 5524 4A28.tmp 5576 4A86.tmp 4616 4AE4.tmp 944 4B32.tmp 760 4B90.tmp 2204 4BDE.tmp 5664 4C3B.tmp 3956 4C99.tmp 2620 4CF7.tmp 5880 4D55.tmp 2008 4DA3.tmp 2080 4DF1.tmp 4516 4E3F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3604 wrote to memory of 3064 3604 2024-03-10_3b3e281cc0dc0d9b4f2773e1a9f43918_mafia.exe 89 PID 3604 wrote to memory of 3064 3604 2024-03-10_3b3e281cc0dc0d9b4f2773e1a9f43918_mafia.exe 89 PID 3604 wrote to memory of 3064 3604 2024-03-10_3b3e281cc0dc0d9b4f2773e1a9f43918_mafia.exe 89 PID 3064 wrote to memory of 1132 3064 36DF.tmp 90 PID 3064 wrote to memory of 1132 3064 36DF.tmp 90 PID 3064 wrote to memory of 1132 3064 36DF.tmp 90 PID 1132 wrote to memory of 1184 1132 375C.tmp 91 PID 1132 wrote to memory of 1184 1132 375C.tmp 91 PID 1132 wrote to memory of 1184 1132 375C.tmp 91 PID 1184 wrote to memory of 1604 1184 37D9.tmp 92 PID 1184 wrote to memory of 1604 1184 37D9.tmp 92 PID 1184 wrote to memory of 1604 1184 37D9.tmp 92 PID 1604 wrote to memory of 5516 1604 3846.tmp 94 PID 1604 wrote to memory of 5516 1604 3846.tmp 94 PID 1604 wrote to memory of 5516 1604 3846.tmp 94 PID 5516 wrote to memory of 4356 5516 38C3.tmp 97 PID 5516 wrote to memory of 4356 5516 38C3.tmp 97 PID 5516 wrote to memory of 4356 5516 38C3.tmp 97 PID 4356 wrote to memory of 4000 4356 3940.tmp 98 PID 4356 wrote to memory of 4000 4356 3940.tmp 98 PID 4356 wrote to memory of 4000 4356 3940.tmp 98 PID 4000 wrote to memory of 5320 4000 399E.tmp 99 PID 4000 wrote to memory of 5320 4000 399E.tmp 99 PID 4000 wrote to memory of 5320 4000 399E.tmp 99 PID 5320 wrote to memory of 6064 5320 39FC.tmp 100 PID 5320 wrote to memory of 6064 5320 39FC.tmp 100 PID 5320 wrote to memory of 6064 5320 39FC.tmp 100 PID 6064 wrote to memory of 4520 6064 3A59.tmp 101 PID 6064 wrote to memory of 4520 6064 3A59.tmp 101 PID 6064 wrote to memory of 4520 6064 3A59.tmp 101 PID 4520 wrote to memory of 5240 4520 3AC7.tmp 102 PID 4520 wrote to memory of 5240 4520 3AC7.tmp 102 PID 4520 wrote to memory of 5240 4520 3AC7.tmp 102 PID 5240 wrote to memory of 4864 5240 3B15.tmp 103 PID 5240 wrote to memory of 4864 5240 3B15.tmp 103 PID 5240 wrote to memory of 4864 5240 3B15.tmp 103 PID 4864 wrote to memory of 5452 4864 3B73.tmp 104 PID 4864 wrote to memory of 5452 4864 3B73.tmp 104 PID 4864 wrote to memory of 5452 4864 3B73.tmp 104 PID 5452 wrote to memory of 4832 5452 3BE0.tmp 105 PID 5452 wrote to memory of 4832 5452 3BE0.tmp 105 PID 5452 wrote to memory of 4832 5452 3BE0.tmp 105 PID 4832 wrote to memory of 2612 4832 3C5D.tmp 106 PID 4832 wrote to memory of 2612 4832 3C5D.tmp 106 PID 4832 wrote to memory of 2612 4832 3C5D.tmp 106 PID 2612 wrote to memory of 4448 2612 3CCA.tmp 107 PID 2612 wrote to memory of 4448 2612 3CCA.tmp 107 PID 2612 wrote to memory of 4448 2612 3CCA.tmp 107 PID 4448 wrote to memory of 3300 4448 3D38.tmp 108 PID 4448 wrote to memory of 3300 4448 3D38.tmp 108 PID 4448 wrote to memory of 3300 4448 3D38.tmp 108 PID 3300 wrote to memory of 3052 3300 3D86.tmp 109 PID 3300 wrote to memory of 3052 3300 3D86.tmp 109 PID 3300 wrote to memory of 3052 3300 3D86.tmp 109 PID 3052 wrote to memory of 440 3052 3DE4.tmp 110 PID 3052 wrote to memory of 440 3052 3DE4.tmp 110 PID 3052 wrote to memory of 440 3052 3DE4.tmp 110 PID 440 wrote to memory of 2116 440 3E41.tmp 111 PID 440 wrote to memory of 2116 440 3E41.tmp 111 PID 440 wrote to memory of 2116 440 3E41.tmp 111 PID 2116 wrote to memory of 1624 2116 3E8F.tmp 112 PID 2116 wrote to memory of 1624 2116 3E8F.tmp 112 PID 2116 wrote to memory of 1624 2116 3E8F.tmp 112 PID 1624 wrote to memory of 3320 1624 3EFD.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-10_3b3e281cc0dc0d9b4f2773e1a9f43918_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-10_3b3e281cc0dc0d9b4f2773e1a9f43918_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\36DF.tmp"C:\Users\Admin\AppData\Local\Temp\36DF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\37D9.tmp"C:\Users\Admin\AppData\Local\Temp\37D9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\3846.tmp"C:\Users\Admin\AppData\Local\Temp\3846.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\38C3.tmp"C:\Users\Admin\AppData\Local\Temp\38C3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\3940.tmp"C:\Users\Admin\AppData\Local\Temp\3940.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\3A59.tmp"C:\Users\Admin\AppData\Local\Temp\3A59.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\3B15.tmp"C:\Users\Admin\AppData\Local\Temp\3B15.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"23⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"24⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"25⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"26⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"27⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"28⤵
- Executes dropped EXE
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"29⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"30⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"31⤵
- Executes dropped EXE
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"32⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"33⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"34⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"35⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"36⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"37⤵
- Executes dropped EXE
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"38⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"39⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"40⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"41⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"42⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"43⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"44⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"45⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"46⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"47⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"48⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"49⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"50⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"51⤵
- Executes dropped EXE
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"52⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"53⤵
- Executes dropped EXE
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"54⤵
- Executes dropped EXE
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"55⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"56⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"57⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"58⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"59⤵
- Executes dropped EXE
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"60⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"61⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"62⤵
- Executes dropped EXE
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"63⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"64⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"65⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"66⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"67⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"68⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"69⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"70⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"71⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"72⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"73⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"74⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"75⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"76⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"77⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"78⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"79⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"80⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"81⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"82⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"83⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"84⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"85⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"86⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"87⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"88⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"89⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"90⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"91⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"92⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"93⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"94⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"95⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"96⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"97⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"98⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"99⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"100⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"101⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"102⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"103⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"104⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"105⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"106⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"107⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"108⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"109⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"110⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"111⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"112⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"113⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"114⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"115⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"116⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"117⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"118⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"119⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"120⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"121⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"122⤵PID:1124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-